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(57) ABSTRACT 

An electronic voting system with a headquarters unit, a 
plurality of precinct units, a plurality of voting stations 
associated with each precinct unit, and a plurality of mobile 
memory units (MMUs) to contain data that can be trans- 
ported back and forth between the headquarters unit and the 
precinct units. The MMUs include FLASH memory, 
wherein each memory location can be written to once and 
read many times. Each memory location can thus only be 
subsequently written to after all the data in the entire FLASH 
memory has been erased. The system includes the ability to 
store images of the cast ballots at multiple locations for 
verification and authentication. The system includes the 
ability to store a direct representation of the voter's selec- 
tions as displayed to the voter as a redundant image of the 
ballot. The system also includes the abQity for each voting 
station to automatically read the particular ballot overlay 
thereon to verify the proper ballot style is being used. The 
system also includes the ability to communicate between the 
various components of the system when the components are 
in a storage configuration. The various components of the 
system can be folded from a deployed configuration into the 
storage configuration so that the largest two-dimensional 
aspect in the storage configuration is a fraction of that in the 
deployed configuration. The system also includes a remote 
sensing terminal and a text-to-speech converter for use by 
disabled persons. An absentee ballot that can be read by the 
voting system is also provided as is the ability to vote over 
a computer network, such as the Internet. 

31 Claims, 29 Drawing Sheets 
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ELECTRONIC VOTING SYSTEM 

The present invention relates to an integrated voting 
system which is electronic at ali stages in the system and» 
more particularly, to a voting system with a reusable, non- 
volatile memory module transportable between difl'erent 
levels of the election system to pass data iherebclween, and 
relates further to improved features for determining and 
verifying that the appropriate ballot form is being used at a 
particular voting station. The present invention also relates 
to verifying that the voter's ballot selection displayed to the 
voter is identical to the ballot image recorded electronically, 
to improved storage for between election equipment man- 
agement and testing, and to an improved absentee voting 
system. 

BACKGROUND OF THE INVENTION 

Voting systems in place around the world typically 
involve either paper balloLs or mechanical counters. The 
paper ballots used in some areas may be as simple as a form 
onto which the selected candidate's name is written or on 
which an X is placed to indicate the candidate selected by 
the voter. Alternatively, the paper ballot may have holes 
punched therein adjacent to the desired candidate or ballot 
issue. With such ballots, the only time the voter is required 
to write on the ballot is if a write-in candidate is selected. 
There are many disadvantages to such paper ballot systems. 
One is the fact that paper ballots can become physically 
damaged, or altered, between the time the voter makes the 
selection and the time a ballot-counting machine eventually 
reads the voter's selection on the ballot. Another disadvan- 
tage is that voters can inadvertently punch the hole or place 
the X next to a different candidate than was intended by the 
voter. When this goes unnoticed by the voter, the voter ends 
up casting a vote which was not intended. In addition, 
write-in voles must be manually read by an election ofiBcial, 
which is time consuming and may be very diflScult, depend- 
ing upon the legibility of the voter's handwriting. In many 
cases, the name written in cannot be read and the vole does 
not count. Also, paper ballots must be custom printed for 
each election, with at least one ballot printed for each 
potential voter. Since these ballots are specific to a particular 
election, the costs are significant for each election. 

Many other election systems include a system of 
mechanical switches and levers which are actuated by the 
voter to increment one of a plurality of mechanical counters. 
At the end of the election, the counters for each of the 
candidates at each of the voting booths is tallied and the 
results are reported to the jurisdictional headquarters. While 
this system solves some of the problems of the paper ballots, 
the machines required al each of the voting booths are fairly 
expensive and have many mechanical parts which require 
routine maintenance and repair. In addition, these machines 
are heavy and cumbersome to move and set up. Another 
disadvantage is the manual tallying of the counters required 
at the precinct level and the manual reporting of the results 
to the jurisdictional headquarters. 

There are a variety of other non-electronic methods for 
conducting an election. Unfortunately, each suffer from 
many of the problems discussed above: illegible ballots 
which must be discarded, votes inadvertently cast for unin- 
tended candidates, excessive costs for election consumables, 
and the ease with which the election results may be altered 
by tampering. 

While some electronic voting systems have been devel- 
oped to solve some of these problems, none of these 
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proposed electronic voting systems has been successful 
enough to result in widespread use. In the areas where 
non-mechanical means for conducting elections are used, 
the electronic components typically make up only a portion 

5 of the overall system so that it is not an integrated system. 
Thus, some of the steps in the election process are still 
performed manually. 

Some of the proposed electronic systems include a form 
of transportable memory, which is used to transport data 

10 between the jurisdictional headquarters and the precinct. It 
is believed that all of the transportable memory methods 
proposed to date require either internal batteries to maintain 
the data contained therein, or else the memories are physi- 
cally altered to maintain the stored data. One drawback of 

15 the internal battery technique is the risk of power interrup- 
tion when the batteries lose their charge. In addition, the 
batteries must be recharged or replaced on a regular basis, 
adding to the cost of the system. An example of a physically 
altered memory is an optical disk which can be written to 

20 only once for each memory location. Thus, the optical disk 
must be replaced for subsequent elections, or else the optical 
disk must have sufiBcient capacity to store data for multiple 
elections, at the end of which the optical disk must be 
replaced. Of course, the cost of these disks is another 

25 election consumable cost. 

In addition, the transportable memory devices disclosed 
in the prior art are intended to be transported to a specific 
precinct as they each contain data relevant only to that 
specific precinct. Such a system will not operate properly if 
the wrong transportable memory device is transported to a 
particular precinct. This would mean, at a minimum, at least 
two precincts would have their voting terminals incorrectly 
configured and would, at a minimum, delay opening of the 
polls at those precincts which were affected. Worse yet, the 
error might not be discovered and the entire election con- 
ducted with the incorrect configuration for some number of 
precincts. One known system requires two memory modules 
to complete the voting process at the precinct, further raising 

^ the potential for error, 

A variety of methods for securing the data in these 
proposed electronic systems has been disclosed. Most take 
the form of either redundantly storing the data or disabling 
the device so that no further data can be written to that 
device. While redundantly storing data may at first blush 
appear to add some level of security, it does not protect 
against writing the wrong data redundantly. In order to be 
sure thai the wrong data is not written, it must be verified as 
correct prior to writing it redundantly. 

50 Other electronic-based systems include video display 
screens similar to computer monitors which present the 
required information to the voter. Such systems require the 
voter to scroll through the available options to make their 
selection. This may be confusing to some voters who may 

55 become lost and frustrated in the hierarchy of screen 
formats, so as not to complete their ballot or to erroneously 
do so. Further, many voters are intimidated by operating 
computer-based technology and may choose not to vote. 
Another electronic-based system includes voting tablets 

60 with printed ballot overiays laid on top of the voting tablet. 
The voter can actuate selected swatches from a matrix of 
switches to make their selections. Unfortunately, as with 
many of the other systems, the feedback provided to the 
voter that the desired candidate was selected is disconnected 

65 from the data electronically stored regarding the cast ballot 
in the electronic system. In other words, it is possible that a 
voter would receive an indication or feedback that one 
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candidaie had been selected when actually the system 
recorded a vote for a competing candidate. 

Another problem with most electronic-based systems is 
the inability to deal with differing ballot styles even within 
a precinct, wherein certain voters may be eligible to vole on -^^ 
certain races and other voters eligible to vole on other races. 
Most electronic-based systems must be manually controlled 
to provide the proper ballot styles to each voter or the proper 
combinations selected from among many to provide the 
correct eligibility for the voter. This places undue burden on ^0 
the operator and presents significant opportunity for error. 

Other proposed electronic-based systems include a 
machine readable card given to each voter, 'ilie voter must 
be given the appropriate card for that voter, and then 
properly place the card in a voting terminal before they can 
vote. Because of the possibility of errors in each of these 
steps, such systems have their drawbacks as well. 

It is against this background and the desire to solve the 
problems of the prior art that the present invention has been 
developed. 

SUMMARY OF THE INVENTION 

Accordingly, it is an object of the present invention to 
provide an improved voting system which is electronic and 25 
integrated at all levels. 

It is also an object of the present invention to provide an 
improved voting system which has a relatively low number 
of consumables for each election conducted. 

It is further an object of the present invention to provide 30 
an improved election system which is highly accurate, both 
in terms of maximizing the ability of the voter to accurately 
select their intended candidate and in the ability of the 
election system to accurately convert the voter's selection 
into the final cumulative tally of votes at the jurisdictional 35 
headquarters. 

It is still further an object of the present invention to 
provide an improved election system which instills confi- 
dence in the voting public as to the accuracy and relative 
difSculty of tampering with the system. 

It is still further an object of the present invention to 
provide an improved election system which is easy to use 
both for the voters and for election oflScials having little 
training. 

It is still further an object of the present invention to 
provide an improved election system which operates in a 
variety of environmental conditions, including varieties of 
ambient lighting, and available connections for power and 
telecommunications, 

50 

It is yet further an object of the present invention to 
provide an improved election system which is easy to store, 
easy to set up, and easy to take down. 

Additional objects, advantages and novel features of this 
invention shall be set forth in part in the description that 55 
follows, and in part will become apparent to those skilled in 
the art upon examination of the following specification or 
may be learned by the practice of the invention. The objects 
and advantages of the invention may be realized and attained 
by means of the instrumentalities, combinations, and meth- 50 
ods particularly pointed out in the appended claims. 

To achieve the foregoing and other objects and in accor- 
dance with the purposes of the present invention, as embod- 
ied and broadly described therein, the present invention is 
directed to an electronic voting system including a head- 65 
quarters unit with a central computer and a plurahty of 
precinct uniLs, each precinct unit including a network con- 
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troUer. The system also includes a plurality of mobile 
memory units, each of the mobile memory units conncclable 
to the central computer to provide data to and receive data 
from the central computer and conneciable to any of the 
precinct units 10 provide data to and receive data from the 
network controller, wherein the data is stored in the mobile 
memory unit in at least one memory device that can be 
written to once and read from many times. The system also 
includes a plurality of voting stations, each station being in 
data communication with one of the plurality of precinct 
units, each voting station including a voting tablet on which 
a voter can select the candidates and sides of issues to vote 
on and can cast a ballot by actuating a cast ballot actuator on 
the voting tablet to cause an electronic ballot image of the 
voter's cast ballot to be commimicated to the network 
controller. The network controller provides data representa- 
tive of the ballot image to the mobile memory unit for 
storage therein and wherein the mobile memory units are 
transportable between the precinct units and the central 
computer to transport data therebetween including represen- 
tations of the ballot images to the central computer. 

The memory device may include flash memory. The 
memory device may store data magnetically. The data 
provided to the network controller from the central computer 
via the mobile memory unit may include a plurality of 
different ballot styles that may be appropriate for different 
precincts within the jurisdiction. ITie electronic ballot image 
of the voter's cast ballot may also be stored in the network 
controller. The electronic ballot image of the voter's cast 
ballot may also be stored at each voting station. The voting 
tablet may include a plurality of display indicators to pro- 
vide a visible indication to the voter of the ballot selections 
made by the voter, and the voting tablet further includes a 
plurality of sensors providing signals representative of the 
state of the display indicators, the signals providing a 
redundant indication to authenticate the ballot cast by the 
voter, the redundant indication of the cast ballot being stored 
at the voting station. The plurality of voting stations may be 
connectable to each other with only one of the voting 
stations directly connected to the network controller to allow 
the remaining voting stations to be connected indirectly to 
the network controller through the interconnection of the 
voting stations. The plurality of voting stations may be 
daisy-chained together. 

The present invention is also directed to an electronic 
voting system including a central computer for collecting 
ballots cast by voters and a plurality of voting stations 
communicating with the central computer, the voting sta- 
tions each including a base with a plurahty of voting 
switches, a plurality of display indicators, and a plurality of 
sensors, the voting switches providing an indication to the 
central computer of the ballot cast by the voter, the display 
indicators providing a visible indication to the voter of the 
ballot selections made by the voter, the sensors providing 
signals representative of the state of the display indicators, 
the signals providing a redundant indication to authenticate 
the ballot cast by the voter. 

The present invention is also directed to an electronic 
voting system including a central computer for collecting 
ballots cast by voters and a plurality of voting stations 
communicating with the central computer, the voting sta- 
tions each including a base with voting switches, the base 
being receptive of a ballot overlay, the ballot overlay includ- 
ing text or other symbology providing information to the 
voter relating to the various races and issues to be decided 
in the election, the ballot overlay further including a coded 
region thereon with a code representative of a ballot style 
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encoded therein, the base including a code reader proximaie ^Ilie present invention is also directed to a method tor 

to the coded region of the ballot overlay when the ballot conducting an election, at least in pari over a computer 

overlay is placed in position on the base, the code reader network including a central election computer and a plural- 

bcing operational to read the code encoded in the coded ity of other computers accessible by a voter, the other 
region of the ballot overlay and to supply the code to the 5 computers being connected to the election computer through 

voting station for configuring the voting system for the the network. The method includes the steps of receiving 

ballot style indicated by the code. identifying information from the voter to authenticate the 

The present invention is also directed to an electronic voter's identity, verifying the voter's eligibihly to vote in the 

voting system having an operational configuration and a election and verifying that the voter has not yet voted in the 

storage configuration. The system includes a plurahty of election, serving voter-specific election information to the 

precinct units, each precinct unit including a network con- one of the other computers accessed by the voter, and 

troller and a plurality of voting stations, each station being receiving information from the voter indicative of the vot- 

in data communication with one of the plurality of precinct er*s selections for the various races and contests in the 

units when said voting system is in the operational election, 
configuration, and each station being capable of being ^5 

placed in data communication with one of the precinct units ^^^^^ DESCRIPTION OF THE DRAWINGS 

when said voting system is in the storage configuration. jhe accompanying drawings, which are incorporated in 

Each voting station may include an external connector for and form a part of the specification, illustrate the preferred 

connection to the network controller that is accessible when embodiments of the present invention, and together with the 
the voting station is in the storage configuration. ^0 descriptions serve to explain the principles of the invention. 

The present invention is also directed to an electronic In the Drawings: 
voting system including a central computer for collecting ^ ^ ^lock diagram of the improved electronic 

ballots cast by voters and a plurahty of votmg stations, each ^j.^jj^^ ^y^j^^ ^^^^^ invention. 

station bemg capable of eventually communicating data to ^ ^ . . . 

the central computer, each voting station having a deployed ^ ^l^' ^ ^ ^ components at election 

configuration in which the voting station can receive selec- headquarters shown in FIG, 1. 

tions from voters and each voting station having a storage 3 is a block diagram of the mobile memory unit 

configuration in which the voting station folds to a fraction shown in FIG. 1. 

of the largest two-dimensional aspect of the voting station in FIG. 4 is a blocK diagram of the components at the 

the deployed configuration when placed in the storage precinct shown in FIG. 1. 

configuration. FIG. 5 is a block diagram of the tablet network controller 

Each voting station may include both a voting tablet that shown in FIG. 4. 
can communicate data and a privacy enclosure that at least FIG. 6 is a perspective view of the tablet network con- 
partially encloses the voting tablet and the voter using the troller shown in FIG 5 

voting tablet. Each of the voting tablet and the privacy 7 ^ ^ sample display screen displayed by the tablet 

enclostire may have a deployed and a storage configuration, network controUer of HG. 6. 
and each told to a fraction or the largest two-dimensional _ _ . 

aspect of the voting station in the deployed configuration ^}^- ^ ^ ^ perspective view of some of the components 

when placed in the storage configuration. ^» P^^'^*"*^^ ^ ^h°^° i° ^• 

The present invention is also directed to an electronic FIG. 9 is a block diagram of the components of the voting 

voting system including a central computer for collecting tablet of FIG. 4. 

ballots cast by voters and a plurality of voting stations, each FIG. 10 is a perspective view of the voting tablet of FIG. 

station being capable of eventually communicating data to ^• 

the central computer, at least one of the voting stations 45 FIGS. 11a, 116, 11c, and lid are sequential perspective 

having a remote sensing terminal to receive inputs from a viewsof the voting tablet of FIG. 10 showing how the voting 

device adapted for use by disabled persons. tablet is folded and stored in a storage container. 

The present invention is also directed to an electronic FIG. 12 is a different perspective view of the voting tablet 

voting system including a central computer for collecting of FIG. 11c. 

ballotscastby voters and a plurality of voting stations, each 50 FIG. 13 is a perspective view of the underside of the 

station being capable of eventually communicating data to voting tablet showing the positioning of a scanner module, 
the central computer, at least one of the voting stations piG. 14 is a side view of the voting tablet of FIG 13 

having a text-to-speech converter to provide an audio output showing the positioning of the scanner module 
to voters unable to read a ballot appearing on the voting cm i« • .■ r.i. , , rr-r^ 

^^j^j^^ ^ ^ FIG. 15 is a perspective view of the votmg tablet of FIG. 

_ ■ . ^^10 with a graphical ballot overlay in place. 

The present mvention is also directed to a ballot system i/-- u • ^ • 1 . . . 

1 • . J* L . • i_ L ,• . r 10. 16 is a schematic of a visual vote verification circuit 

inciuamg a prmiea top sDeet w,tn symbolic representations ^^^^^.^^^ 

in the voting tablet. 

of races and contests for a particular election, the top sheet „, _ . _ . . • r- 

having fields in which a voter can make marks indicating ™- ^ scnematic of an alternative visual vote 

selections for any of the races and contests. The ballot 60 verification circuit contained in the voting tablet, 
system also includes a corresponding bottom sheet remov- FIG. li^ is a perspective view of a privacy enclo.sure of the 

ably attached to the top sheet, the bottom sheet having precinct equipment shown in FIG. 8. 
printed data processing graphical marks and having fields FIGS. 19a and 19b are perspective views of a privacy 

corresponding to the fields on the top sheet. The lop sheet enclosure of the precinct equipment shown in FIG. 8, 
and bottom sheet cooperate together to allow the voter 65 showing curtains in a closed position and an open position, 
marks on the top sheet to be copied onto the corresponding FIGS. 20a through 20/ are perspective views of the 

fields on the bottom sheet. folding sequence of the privacy enclosure. 
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FIG. 21 is a perspective view of a plurality of the storage required functions to manage and conduct elections. The 

containers shown in FIG. U*^, each containing voting central coniponeiu is the ceuiral computer 42, such as a 

tablets, shown on a storage rack and interconnected for Windows®-based Personal Computer (PC) with sufficient 

testing thereof. memory and storage capacity lo efficiently operate graphics- 

FIG. 22 is a perspective view of a storage box into which 5 software. Preferably, the central computer 42 has a 

one of the tablet network controllers shown in FIG. 6 is f.^^'^'^^ ^.^'^"f ^ PP^ ^"^^ ^°i?P^S!J^^f^ (C?] 

. t' 1! • t H du\'t 43 thai has data wnle capability. The CD dnve 43 

snown paniaiiy insenea. functions as a Write Once Read Many (WORM) and is used 

no. 23 IS a perspective view of a plurahty of the storage as a permanent archive of all activities performed on the 

boxes shown m FIG. 22, each containing one of the tablet central computer 42. The central computer 42 has input/ 

network controllers, shown on a storage rack and intercon- output capacity to be able to connect at least five external 

nected for testing thereof. peripherals. 

FIG. 24 is a typical display screen which may be viewable '^^^ external peripherals support data input/output to the 

on the computer at election headquarters as shown in FIG. central computer 42 and include an absentee ballot docu- 

2. rnent scanner 62, a ballot production device 64, an election 

mr- ie • a i. r i • Tcsults printer 66, and a ballot box bav 68. The document 

no. 25 ts a process flow chart of the process on election ^,„„er 62 may be one such as manufactured by Hewlett 

day usmg the electronic votmg system of FIG. 1. p.^j^.^j^ ^^^^^j ^^^^er ScanJet 5pse. The scanner 62 pro- 

FIG. 26 IS a top view of an absentee ballot of the present duces images that are managed by the absentee ballot 

invention module under EAS control. The ballot production device 64 

FIG. 27 is a flow chart of the process flow in scanning and 20 produces ballot overlays 65 and can be either a large format 

counting the absentee ballots of FIG. 26 by the system of laser printer or a plotter commonly used for engineering 

FIG. 1. drawings. Examples are the Xante Accel-aWriter-8200 and 

RG. 28 is a flow chart of the process flow of a warehouse ^^e NovaJet PRO 42e, respectively. The selection of which 

checkout process of the system of FIG. 1. printer is used is made by the jurisdiction and is based on 

no. 29 is a block diagram of the data and power average ballot size, desired speed of printing, and cost. The 

interconnection of the voting tablets of FIG. 21 when stored ^"PP«,^ ^yP^ production device, 

together in a warehouse. election results printer is a standard laser printer 66 

mo in V « fl«, . . f .u a -r a found in any computer hardware store. A separate printer is 

FIG. 30 is a flow chart of the process flow performed -j j r - i i ^ 

. , n . • • ^ r t provided tor prmting election results because reports are 

when a voter utilizes a Remote Sensmg Terminal of he • i o c 1 1 « r . i^j 

. « er:ir- i -30 generated in regular 8.5"xH" paper format and do not 

system 01 FIG. 1. ^ . • i- j • fx • i_- - . . 

. ^ - . t , , . require any specialized pnntmg. Using this type of printer IS 

FIG. 31 IS a functional block diagram of an Internet more cost effective. The ballot box bay 68 is used to read and 

portion of the election system of the present invention. ^^te to the mobile memory units (MMU) 58. 

DETAILED DESCRIPTION OF THE ^^^^^ 

PREFERRED EMBODIMENTS "'^ ballot box bay 68 is a stand-alone unit that supports 

reading and writing of the MMUs 58. The ballot box bav 68 

The improved electronic voting system 40 the present provides the option to download election specific informa- 

invention includes a central computer 42 located at an tion prior to the election but its primary function is reading 

election or jurisdictional headquarters 44 and subsystems 46 the post-election results. Once the polls close, the MMU 58 
located at a multiplicity of precincts 48 associated with the 40 is removed from the TOC 50 at each precinct 48 and 

election headquarters 44 (FIG. 1). The subsystem 46 at each physically transported to headquarters 44. The MMU 58 is 

of the precincts 48 includes a controUer 50 connected to a inserted into an open slot in the ballot box bay 68. The EAS 

network of voting stations 52, also known as a tablet 60, in election taUy mode, polls the ballot box bay 68 slots, 

network controller (TNC) 50. Each voting station 52 has a detects that an MMU 58 has been inserted and uploads the 
privacy enclosure 54 in which a voter may cast his or her 45 data contained therein. The ballot box bay 68 has indicator 

ballot. The privacy enclosure 54 encloses a voting tablet 56 lights that tell the user when the uploading is in progress and 

which is in communication with the tablet network control- when it is complete. The MMU 58 stiU contains a copy of 

ler 50. A mobile memory unit 58 is transportable between the data it contained but a copy has been made by the EAS 

the jurisdictional headquarters 44 and the precinct/ 60 through the ballot box bay 68. 

subsystem to faciUtate data communication therebetween. 50 The baUot box bay 68 is controUed by the central com- 

The mobile memory unit 58 is selectively connectable to puter 42 and the EAS 60. The ballot box bay 68 is handled 

either the central computer 42 at election headquarters 44 or as an external computer peripheral and is linked to the 

the network controUer 50 of the subsystem 46 at the precinct computer 42 through a computer cable. The ballot box bay 



68 is a standard computer card expansion bay with its own 



48 

The central computer 42 at election headquarters 44 can 55 power supply. The expansion bay can hold up to eight 

be functional throughout the election year to assist with a "cards*' in slots provided at the front of enclosure. Depend- 

variety of tasks related to the election. These tasks include ing on the number of MMU reader slots that a jurisdiction 

ongoing tasks such as election and ballot preparation, absen- wants, a PC card is iustallcd in the expansion bay to satisfy 

tec voting, early voting, and management control, as well as those requirements. The PC card has a PCMCIA connector 

tasks relating to election day itself such as election tally, 60 (a standa-d defined by the Personal Computer Memory Card 

election preferences, reports/statistics, and functions relating International Association) and mechanical support to 

to the poll workers. In addition, the central computer 42 accommodate the MMU 58. An electronic circuit to facili- 

provides security functions to the overall election system. late communication between the central computer 42 and the 

Election Headquarters MMU 58 are also part of the PC card. 

As shown in FIG. 2, the equipment at election headquar- 65 Election Management Software (EAS) 

ters 44 includes the hardware necessary to run an Election llie EAS 60 is a custom developed software program that 

Administration Software (EAS) 60 and support the other runs on the central computer 42. The EAS 60 is created 
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based upon a commercial database program, such as The audit trail provides means to reprociuce. to a reason- 

Microsori Access, with a custom interface specific to this able degree, all events leading up to an election, the election 

application. All user interface screens are customized and day events, and post-election activities up until the election 

the interrelation of the data is custom mapped and managed. is completed and ccrtiticd as closed, ^rhercforc, the WORM 

The commercial database program is used for file structure 5 drive 43 also stores a record of all "sessions" on the EAS 60. 

and data manipulation. Alternatively, it would be possible to When a user performs any operation on the EAS 60, it will 

obtain rights in a third parly^s software such as "Ballot impact the stored election data and, in the interest of security 

Right" produced by United Stales Election Corporation of and data integrity, any changes or alterations would be 

West Chester, Pennsylvania, and customize it to this appli- traceable to prevent unauthorized activity or tampering. This 

30 is part of the audit trail that must exist for all elections so that 

To accomplish this versatility, the EAS 60 includes sev- the election process and procedures can withstand public 

eral different databases operated under a common user scrutiny. The audit trail is incorporated throughout the 

interface. The user interface has a title screen that oilers the system, beginning with the EAS 60 and continuing through 

user several different functions that are selected depending to the precinct equipment. Every event where there is a 

on the task at hand. Each of these functions, when selected, is change in the state of the information stored for the election 

will take the user to a new screen specific to the selected must be recorded, and is subsequently stored on the WORM 

function and guide him through the required task. These drive 43 at the end of the election. Each component of the 

functions include, but are not limited to voter registration, system 40 participi.cs in collecting and maintaining audit 

precinct geographic boundary definition, absentee and cariy trail information an*' is described at the appropriate time 

vote, election data entry, ballot creation, results tallying, 20 within this descripti< 

report printing, user preferences and on-line help. Beneath In preparation of an election, election data is entered, 
this user interface, the system is accessing the different processed, and output in several formats. The electronic 
databases required to manage aU the election data. version of the ballot configuration produced by the EAS 60 
The separate, independent databases have the abihty to is used to set up the voting tablet electronically for the ballot 
transfer and share data back and forth as required, as the sum 25 that is assigned to a particular precinct through the equip- 
of the databases is required for election management. The ment list. The voting tablet 56 provides a large matrix of 
databases include voter registration, geographic districting, membrane switches that are selectively enabled for a par- 
campaign finance, absentee and early vote data, election ticular election which provides the greatest efficiency and 
design, election taUy and reports. The voter registration flexibility when the EAS 60 lays out the ballot. The elec- 
database is used for entering, purging, maintaining, and 30 tronic baUot is one packet of data that is contained in the 
keepmg up-to-date voter registration data and has the ability mobile memory unit (MMU) 58 when it is mated with a 
to generate the jurisdiction's required mailings to registered tablet network controUer (TNC) 50 at a particular precinct 
voters. The geographic districting database is used to 48. Other information in the MMU 58 includes voter reg- 
develop, manage, and alter geographical boundary defini- istration information that is used for voter authorization 
tions of precincts and voter eligibility information and 35 during the election, a list of ballot styles and their assigned 
produces matenal necessary for the logistical support of precincU a valid equipment list, and security data. The 
staging elections. The campaign finance segment maintains information in the MMU 58 establishes the complete 
records of campaign finance disclosures, candidate requirements for conducting an election at any precinct 48, 
information, and other information required by statute. The not just at a specific precinct. 

absentee vote database maintains and manages absentee 40 The ballot overlay 65 has a single-sided laminate apphed 

voter lists and produces absentee ballot material and main- as part of the ballot production process that serves to protect 

tains images of returned baUots. The early vote database is the baUot overiay 65 when placed in the voting tablet 56 at 

for ballot styles, equipment lists and schedules, voter turn- the precinct 48. Alternatively, the overlay 65 could include 

out lists, and early voted ballot images. The election design reverse printing on a transparent or translucent material 

database is used for election preparation and includes ballot 45 Mobile Memory Unit 

layout and production, equipment lists, and electronic and The MMU 58 (FIG. 3) is a reusable data storage device 

graphic version of the many different ballot styles. The that can permanently maintain stored information in the 

tallymg and reports databases count election results and absence of power. The technology employed can be elec- 

produce certified reports, respectively The above descrip- tronic memory that maintains its stored information when 

tion of the database functions and contents is not intended to 50 power is removed, or it can be rewrileable optical media For 

be all mclusive, but merely to provide one skiUed in the art example, the MMU 58 could be a card of FLASH memory 

a sampling to demonstrate the interconnectivity and range of llie MMU 58 is preferably not magnetic or write-once 

information contained therein. media. Magnetic media present a reliability and security risk 

Ihe hAS 60 continuously participates in updating the while write-once media impacLs one of the major advantages 

requirements ofmanagmg non-election day information that 55 of an electronic voting machine-^st. Write-once media 

is mtegral to the election process. The wealth of information would have to be replaced for every precinct for each 

IS stored in the computer 42 on an internal hard drive and on election, Ihus driving up the expense for "election consum- 

the complementary Write Once Read Many (WORM) opti- ablcs" and hence, the cost of producing an election 

cal disk 43. The WORM drive 43 provides the greatest The physical design of the MMU 58 is dependent on the 

rehabihty available m computer data storage, offers a large 60 technolo-y used but will typically include a protective 

data storage capacity m a compact footprint and has a very enclosure 70 and a means for locking the MMU 58 into the 

long data retention capability. The WORM drive 43 is the TNC 50. The enclosure 70 is sealed so that it cannot be 

central means for archivmg all election information opened without damage. This prevents unauthorized tam- 

mcluding, but not limited to all databases, ballot images, and pering. The present invention utihzes the PCMCIA standard 

the election history, commonly referred to as the "audit 65 Type I, that was developed for the portable computer market' 

traU . Alternatively, this data could be stored on a high- As mentioned above, once the MMU 58 is inserted into the 

density, solid-state storage device. TNC 50, it is completely enclosed and the removal mecha- 
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nism is disabled by [he TNC software to lock the MMU 5S 
in place. This prevents the MMU 58 from slicking out of the 
TNC 50 to minimize possible damage when being trans- 
ported or handled. Adopting the PCMCIA standard dictates 
the form factor of the device with minor modification. The 
receiving bay of the TNC 50 and the enclosure 70 of the 
MMU 58 deviate from the exact PCMCIA standard in that 
the MMU 58 will be completely swallowed into the receiv- 
ing bay like a diskette in a personal computer. While the 
MMU 58 is very similar to the PCMCIA standard 
mechanically, it is not similar electrically. In addition, the 
connector pin configuration is altered to further prevent 
unauthorized insertion. Even the mechanical difTerences will 
be such thai an ofT-lhe-shelf device employing the PCMCIA 
standard cannot be inserted into the TNC 50. 

The MMU 70 enclosure contains a single printed circuit 
board (PCB) that has the MMU electronics assembled to it. 
The PCB is raountcd within the enclosure with the interface 
connector accessible from one end. The PCB has integrated 
circuits (ICs) mounted to it using Surface Mount Technology 
(SMT) or other high density electronic interconnect 
methods, and the PCB provides electrical connection 
between the ICs. The functions designed into the MMU 58 
include non-volatile memory, communication interface, 
security switch, and electrostatic discharge (ESD) protec- 
tion. 

The MMU 58 uses FLASH memory to provide a physi- 
cally separate memory location for all election sensitive 
information. There are two memory ICs of identical size. 
One IC is used for storing election infonmation and the other 
is used for error detection and correction (EDC) codes. The 
size of the memory can vary and the present invention 
incorporates 4-megabyte ICs which are more than adequate 
to handle the data requirements. The attribute memory is 
contained within the memory ICs but is separately addres- 
sable. The attribute memory stores information about the 
MMU 58, including electronic serial number, MMU con- 
figuration data, security data, jurisdiction and election 
identification, number of times the MMU 58 has been used, 
and other data as may be required, llie communication 
interface provides control logic for addressing the memory 
ICs, management of the data and address bus on the MMU 
58 and necessary buffers used for communication timing and 
control. As additional levels of protection, data encryption 
and password protection for the MMU 58 could be provided. 

The ESD protection provided by the MMU 58 utilizes 
commercially available ICs that typically use a Zener diode 
array to dissipate any incident energy. ESD can cause loss of 
stored information and can even permanently damage ICs. 
The techniques employed by the present invention are well 
known in the industry The interface connector is the modi- 
fied PCMCIA standard that supports hot insertion of the 
MMU 58. T^e ESD protection can either be incorporated 
into the connector or be a separate IC. 
Tablet Network Controller 

As shown in FIGS. 4 and 5, the tablet network controller 
(TNC) 50 manages the election at the individual precincts 48 
through the use of resident firmware, data supplied from the 
mobile memory unit (MMU) 58 and the voting tablet 56. 
The TNC 50 is a stand alone computing unit with standard 
computer functions that support a variety of interfaces 
specific to the present invention. The TNC 50 includes a 
CPU or microprocessor 72 that controls the operation of the 
TNC 50 as programmed by resident firmware. For this 
reason, election specific data information is delivered to the 
TNC 50, via the MMU 58. ITie TNC 50 supports a number 
of peripheral interfaces that, together, define the operational 



i0,548 Bl 

12 

capability of the unit. ^Fhcsc interfaces are described below 
with an explanation of their functions within the election 
process. 

The microprocessor 72, along with the majority of the 

5 interface electronics, is assembled and interconnected on the 
main printed circuit board (PCB) which is mounted within 
a TNC enclosure or housing 74. Several interfaces are used 
as found in most microprocessor-based systems and can be 
categorized into three general areas: direct microprocessor 

10 support, memory, and input/output (I/O). 

Direct microprocessor support includes a data/address 
bus, address decoding, a watchdog timer, and interconnect 
logic functions. The present invention operates on a 16-bit 
wide bas where information is transferred and operated on 

15 16 bits at a time. Bus width determines the speed with which 
information can be moved around, the depth of the address- 
ing capability, and the cost of the components. The 16-bit 
architecture is adequate for the present invention and pro- 
vides more than enough performance while maintaining cost 

20 objectives. Address decoding is a function of bus width and 
is designed such that each of the interfaces can be individu- 
ally identified and controlled by the microprocessor 72. 
Typically, the interfaces to the microprocessor 72 are 
address mapped, along with the memory, to provide an 

25 orderly structure. The watchdog timer is the guard dog of the 
microprocessor system and operates almost independently 
of the microprocessor 72. The watchdog timer essentially is 
required to be updated by the microprocessor at regular, 
fixed intervals of time. If the update occurs, that implies that 

30 the system is functioning normally and the watchdog 
remains dormant. Should an update be late or missed, the 
watchdog initiates a error routine that signals the system that 
operation is not normal. The error routine can vary in its 
function, from running a background diagnostic to shutting 

35 down the system. The interconnect logic is used to make 
address, data and control signals of the various integrated 
circuits (ICs) compatible with one another. Typically, dif- 
ferent manufacturers of ICs are used within a circuit design 
and the interconnect logic accounts for the subtle differences 

40 in connectivity of the ICs. Also included in direct micro- 
processor support is a real time clock (RTC). The RTC is 
provided by an IC that has its own independent battery 
power and maintains the time regardless of whether the TNC 
is powered. The RTC is used for time -stamping events of an 

45 election such as polls open, polls closed, vote counts and 
other auditable events. 
TNC Memory 

The TNC provides temporary and permanent memory for 
use by the voting tablet and three different technologies are 

50 used in the present invention: 1) read only memory (ROM); 
2) random access memory (RAM); and 3) electrically eras- 
able programmable read only memory (FLASH E^PROM). 
The permanent ROM memory stores machine code for 
operation of the TNC. The temporary memory, RAM, is 

55 used to store accumulated voter selections prior to casting 
the ballots and also provides for other microprocessor sup- 
port requirements. The FLASH E^PROM, or FLASH 
memory, is used to permanently store data that will be secure 
when power is removed. All information that is critical to 

60 conducting and report an election is stored in FLASH 
memory. This includes voting tablet configuration data, 
ballot images fiom cast ballots, audit information concern- 
ing various events during polling periods and other data as 
may be required. 

65 All operations which require information to be written to 
any memory location are "backed up" by the incorporation 
of error detection and correction (EDC) methodologies. 
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EDC methodologies can exist in eiiher a hardware or causes the TNC 50 lo become controlled, with other 'IKCs 

software implementation and are widely used in the public 50, and is connected in a serial network with other TNCs 50 

domain for applications that require high data reUability. The to facilitate warehouse testing. The interface connectors are 

basic concept of EDC is to add extra or redundant bits to a wired lo the internal bus of the TNC 50 and arc controlled 

data word that characterize that data word. These extra bits, 5 by the microprocessor 72. 

when properly mathematically coded, have the ability to The TNC 50 can operate one or more voting tablets 56 

completely reconstruct the data word that they represent. simultaneously so thai a single election official could run the 

Therefore, by incorporating EDC in every data word election. The limit to the number of tablets 56 operating 

storage, and storing the extra bits in a separate memory simultaneously is governed only by the operational capabil- 

device, two levels of confidence are created. If the initial lO ity of the precinct workers. The network bus technology 

data word is either corrupted when stored or corrupted when utilized by the present invention has a theoretical limit of 

read, the extra bits can recreate an exact duplicate of that 500 nodes, far greater than any precinct should require, 

word. The second level tx;curs if the primary memory The TNC 50 includes a display 78 (FIGS. 6 and 7) 

storage device fails. In that instance, the failure can at least employing liquid crystal display (LCD) or fiat panel display 

be detected. These are well known techniques but not is technology. These types of displays have a high relative 

previously applied to electronic voting systems where assur- contrast level and when presented to the operator at the 

ances of data integrity are critical. There are many sources optimized viewing angle, substantially prevent unauthorized 

of both hardware and software solutions publicly available. viewing. The display 78 is the central area of the TNC 50 

The present invention utilizes a hardware solution such as and is the primary communication tool for the user interface, 

that available from ECC Technologies that utilizes a byte- 20 The display 78 is controlled by the microprocessor 72 and is 

parallel Reed -Solomon error correcting system, connected, via an internal cable, to the microprocessor bus. 

Also a part of the memory system of the TNC 50, is an Various instructions are displayed on the screen and the 

identification ROM (ID ROM) 76. The ID ROM 76 is a operator responds to the instruction by selecting choices that 

factory programmed serial memory device that contains an are offered on the screen. 

electronic serial number of the TOC 50. Each device in the 25 Response to instructions given on the display or events 
present invention contains a unique electronic serial number initiated by the operator is received through switch actuation 
that is used to identify every event that the particular unit is selected by the operator. The TNC 50 has a set of switches 
involved in. For example, at the closing of the polls, the 80 located along each side of the TNC display 78. The 
electronic serial number is included in the results of the switches 80 can be a tricolor type whose function is defined 
elections. In this manner, all data related to an election is 30 on the display, known as soft-key function switches (soft- 
traceable to the responsible device. keys). As the status of the election- changes through the 
TNC I/O process of conducting the election at the precinct, the 
The TNC 50 controls the tablet operation through a definition of what action the soft-key performs when 
communication link that is a serial network which can selected changes also. For example, during pre-election 
accommodate a very large number of compatible devices. 35 testing, the soft-keys are defined to relate to pre-election 
The preferred communication protocol is the Controller testing and for displaying test results. During the time the 
Area Network (CAN) or similar serial networking protocols. polls are open, the soft-keys are defined in terms of tablet 
CAN uses 11-bit or 29-bit unique identifiers to identify each authorization and displays tablet(s) status. The flexibility is 
device, or node, on the bus. These identifiers carry identi- extensive and is well suited to assist the average poll worker 
fication information and encrypted security data that must be 40 in conducting the election. The soft-keys are connected to 
verified by the receiving device prior to the initiation of each the microprocessor bus and are controlled, in conjunction 
data transfer on the bus. This maintains communication with the display 78, by the microprocessor 72. 
security in each direction of data flow between the TNC 50 In addition to the soft-keys, a numeric keypad 82 is 
and the voting tablet 56 to prevent unauthorized devices employed that accepts input numerical sequences. The 
from being connected to the bus. Built into the CAN 45 numerical sequences may include operator authorization 
protocol are error detection and error signaling functions codes, voter codes taken from the registration log (if not 
along with automatic re-transmission of corrupted messages. using a bar code), and other oCBcial acts that may require 
If a device on the bus fails, the CAN protocol is able to confidential codes as determined by a jurisdiction. The 
differentiate between temporary errors and a failed device actual codes for the various uses is set by the EAS 60 at the 
which allows the other devices to continue to function 50 time the election is prepared so that the codes can be 
normally. The CAN protocol offers a robust link that allows changed between elections. 

for secure communication between the TNC 50 and voting In compliance with many jurisdictional requirements 

tablet(s) 56 and can be implemented either with electronic across the country, the TNC 50 provides a private counter, 

cables or wireless connections. The wireless link may be a displaying total number of votes cast at any particular time 

low power, ultra high frequency (UHF), spread spectrum 55 during the election. The private count can be given on the 

type that is extremely diflScult to receive and decode except TNC display 78 for operator reference only or can be 

by an authorized transmitter or receiver. The TNC 50 and maintained internally only, without display. The require- 

voting tablet 56 are able to support either interface link with mcnts vary with jurisdiction on what statistics are to be 

no modification so that a jurisdiction may select the method. maintained concerning the election equipment. Number of 

Coded connection to the TNC 50 is through interface 60 votes, hears of operation, or any other way to breakdown 

connectors located on the side of the unit. There are two usage may be specified by the election ofiBcials at the time 

connectors, one female and one male. The female connector the election is being prepared. 

is used during the voting process and connects to the first The TNC 50, through its control of the election at the 

voting tablet 56 to initiate the serial CAN network. In this precinct, also maintains the voting tablet status, voter 

configuration, the TNC 50 controls the voting tablets 56. 'llie 65 eligibility, and authorizes voters. The TOC 50 will initiate 

male connector is used for storage of the TNC 50 at the functional tests prior to the opening of the polls and will 

warehouse between election. The storage configuration monitor and record the results of the tests. The voting tablet 
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siatiis has four possible states which the TNC 50 monitors connector for connecting the printer 90 to the TNC 50 in the 

and controls. Once the polls are open, the voting tablet 56 separation wall that separates the printer 90 from the main 

can be in one of the following possible states: Available; In 'I'NC processing section, 'llie back of the TNC housing 74 

Use; Help Requested; or Error Condition. An optional state, where the printer 90 is housed has a hinged access panel 

selected by a particular jurisdiction, is Time Out, where a 5 with locking means that provides for servicing the printer 

voter is taking too much time to complete his vole, a lime 90. Thus, retrieval and re-stocking of paper rolls and main- 

which is set by the election official at the election headquar- lenance of primer failures can be accomplished, without 

lers 44. Transition into each of these states is conlrolled by providing access to the main processing section, 

the TNC 50, with two exceptions. The change from In Use TNC Power 

to Available is triggered by the voter pressing a "Cast Ballot'* 10 Power to the TNC 50 is provided either through a con- 
button 84 on the voting tablet 56 and the Error Condition is ventional AC wall outlet or auxiliary DC input. The wall 
triggered either by the voting tablet 56 sending a message to outlet provides an AC voltage ranging from 90 to 240 VAC. 
the TNC 50 or by the TNC 50 detecting an error. In all other This range covers the standards as they exist around the 
transitions, the election ofTicial operating the TNC 50 is world, including Ihe United States which has standard 120 
required to make a button selection on the TNC control is VAC. AC power is delivered through an acceptable power 
panel to transition a particular voting tablet 56 to another cord that is removable from the side of the TOC 50. The 
s^ale. power input module includes a male pinned connector using 
Determination of voter eligibility is accomplished in a the universal pin configuration for AC power and is also 
couple of ways. Traditional methods include the election fiised. The fiise ratings are set for the TNC power handling 
officials checking printed voter registration logs provided by 20 capability of 5 amperes. The fuse helps protect the TNC 50 
the election headquarters, verifying that a particular voter is from power spikes and short circuits. The TNC 50 has an 
in the proper precinct and on which choices he is allowed to internal step down transformer and power regulation and 
vote. The TNC display 78 provides the operator with a uses an open frame switching power supply commonly 
choice between the various ballot styles that are authorized available in the electronics industry. The auxiliary DC input 
for that precinct, llie election official selects the style which 25 can handle DC voltage ranging from 7 to 24 volts, includiing 
corresponds to a voler*s eUgibility. Selection of a particular 12 volts DC from an automotive battery. The auxiliary DC 
ballot style will enable only those choices on the ballot on power is received through its own separate input connector 
which the voter is allowed to vote. The operator selects the and is appropriately connected internal to the TNC 50 as one 
ballot style as determined from the voter registration log and skilled in the art will recognize. 

then selects the next available voting tablet. 30 The TNC 50 provides power distribution to the various 
The present invention also offers an automated alterna- functions of the TNC 50 and to the voting tablet. The power 
tive. The TNC 50 has a RS-232 serial port 86 located on the to TNC functions is distributed via internal cabling while 
side of the unit which allows a bar code scanner 88 to be power to the voting tablet is pnavided through integration 
connected. The serial port 86 is part of the microprocessor with the CAN communication cable. Incorporating power 
bus and can service a number of peripheral devices. In this 35 and data communication onto the same lines is well known 
case, the bar code scanner 88 is used to scan a voter as illustrated by an article located on the Internet entitled "A 
registration log which has an associated bar code designa- Data Acquisition Node Using CAN with Integrated Power 
tionforeach voter The voter bar code indicates the voter's Transmission," by Dr. Lutz Rauchhaupt, Dr. Thomas 
eligibility and the TNC 50 automatically selects the proper Schlinder. and Henri Schultze, Otto-von-Guericke-Universit 
ballot style. The election oflQcial then assigns an available 40 at Magdeburg Inst itul fur ProzePmeptechnik und Elektronik 
votmg station or booth 52. Furthermore, the scanned infor- (IPE). Incorporating the data and power transmission 
mation can be compared with internally stored data provided together provides for a minimum of cabling and promotes 
by the MMU 58 to ensure the voter is in the proper location simpUcity in set up. The power delivered to the voting tablet 
and is eligible to vote. The TNC 50 makes a pemaancnt need not be regulated power, as the voting tablet has its own 
record of the fact that the voter has voted so that he cannot 45 power regulation capabiUty, This eliminates the possibility 
vote agam in that election. of the delivery of "dirty power" to the components of the 
The TNC 50 has an mlegrated printer 90 that is enclosed voting tablet 56 and accounts for any variation in voltage 
by the TNC housing 74 at one end of the device. The printer drop found in the interconnect cable, 
interface is clectricaUy connected to the TNC data bus The MMU 58 is used to transport data to and from the 
controlled by the microprocessor 72. The printer 90 provides 50 precinct 48 and acts as a physically separate record of the 
printed records for specific events during an election and election on a precinct-by-precinct basis. The TNC micro- 
operates on dual-roll, narrow, carbonless paper. As informa- processor 72 controls the MMU 58 at the precinct 48 and 
lion IS pnnted on the printer 90, paper from both rolls performs the following operations on it: accepting the MMU 
dLspenses simultaneously, one on top of the other. The lop 58; locking it in place during the election; providing a 
copy IS white paper and is prmted and released through the 55 readywrite capabilitv for downloading information immedi- 
pnnt mechanism and removed by the election official. The atcly prior to the election; uploading data during the clec- 
second copy, carbon copy, is rolled onto a take up reel tion; closing the election with precinct level results; rccord- 
mlcrnal to the TNC housing 74. This carbon copy serves as ing audit data; and executing public encryption algorithms to 
a secure record of what information was delivered to the protect the data contained therein. 

official and is part of the audit trail of the election. Typical 60 Once the MMU 58 is fully inserted into the receiving bay 

information pnnted includes precinct results totals, pre- of the TNC 50 it is completely enclosed, similar to a 

election test results, and zero counts and error messages. common computer disk. The preferred mechanical connec- 

User preferences are able to be specified to handle whatever lion type is the PCMCIA standard, developed for portable 

mformation a jurisdiction may require, hence the ever computers. The MMU must be "hot insertable", meaning 

irnportanl flexibihly. ITie printer 90, while enclosed as part 65 that it is required to be in.slalled when the mating receptacle 

of the TNC 50, is actually in a separate compartment at one has power present on respective connector pins. The require- 

end of the TNC housing 74. There exists an electrical ment arises from the fact the TNC 50 needs to have power 
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applied and operational in order to receive the MMU 58. The 
TOC 50 physically prevents a dead (no power) insertion tor 
security purposes. 
Voting Tablet 

^rhc TNC 50 communicates with a plurality of voting 5 
tablets 56 at voting stations 52, as shown in FIGS. 4 and 8. 
The voting tablet 56 (FIGS. 9-15) is a portable, lightweight 
unit that when deployed provides an input means for each 
voter to cast his/her vote. The full text of the ballot is 
presented on printed material in the form of the ballot lo 
overlay 65 which is overlaid on the voting tablet 56. 

The voting tablet 56 has a hinge point 92 vertically down 
the center of the voting tablet 56 so that the voting tablet 56 
may be folded into the transportation and storage configu- 
ratioD, Ofifeet from the center hinge area, hinged on the back is 
panel, is a rectangular box or center storage area 94 that runs 
the length of the voting tablet hinge area. This center storage 
area 94 is twice as wide as the thickness of the voting tablet 
56 and an equal dimension in depth. When in the transpor- 
tation and storage configuration, the back panels, the edges, 20 
and the center storage area 94 of the voting tablet 56 form 
a protective enclosure. The center storage area 94 serves to 
seal the center tablet hinge area and provides access for 
electrical connections to the voting tablet 56 and storage 
area for cables and the light Gxture. There are appropriately 25 
placed latches to prevent tampering and a handle for 
carrying, with the resulting size of the folded tablet 56 
ranging from a large briefcase to a small suitcase. Integrated 
in the voting tablet edge frame is a tongue-and -groove 
valence 96, or any other popular technique for sealing 30 
protective enclosures to prevent damage to the voting tablet 
56 by dtist contamination, moisture, or other environmental 
exposure. 

When deployed at the precinct 48, the voting tablet 56 is 
unlocked and opened up so the two halves are coplanar and 35 
a locking device is provided to secure the voting tablet 56 in 
the open configuration. Integrated mounting hardware is 
provided that mates the privacy enclosure 54 with the voting 
tablet 56 to secure and lock it in place. The two halves of the 
voting tablet 56 are electrically connected at the hinge point 40 
92 using flex or conventional cabling. The center storage 
area 94 hangs from the underside of the voting tablet 56 with 
the interface cables and light fixture stowed therein. There 
are two interface connections used to connect the voting 
tablet 56 to the network of voting tablets 56 and to the TNC 45 
50. Each interface connection can be used to connect to 
either a TNC 50 or to another voting tablet 56 so that a 
plurality of tablets 56 can be daisy-chained together and 
connected at one end to the TNC 50. One connection is a 
flush-mounted, circular, female connector and the other 50 
interface is a twelve to twenty- four foot cable with a circular, 
male connector, the mating version of the other interface 
connector The circular connectors are of the type that have 
a rotatable collar such that when the connector halves are 
mated together, rotating the collar locks the two halves in 55 
place. The interface connectors and cabling are mounted on 
a panel in the center storage area 94 that houses a light 
fixture (not shown). Once the cables arc connected and the 
light fixture deployed, the center storage area 94 is locked 
into place so that it is secured against the back panel of the 60 
voting tablet 56 to prevent tampering. 

Deploying the voting tablet 56 and preparing it for 
conducting an election includes the following tasks: a voting 
tablet control bank 98 is unfolded or slid out and locked into 
position; the voting tablet light fixture is removed and hung 65 
on the back panel of the privacy enclosure 54; the interface 
cable is removed from the center storage area 94 and 



connected either to another voting tablet 56 or to the TNC 
50; the voting tablet 56 is secured lo the privacy enclosure 
54 using integrated hardware; and the center storage area 94 
is locked against the back panel of the voting tablet 56. 

An aitcrnalivc embodiment of the voting tablet (not 
shown) may include a touch screen, including display tech- 
nology such as LCD, flat panel, CRT, or any large format 
group display. These types of displays can be easily incor- 
porated in the same network methods as with the first 
embodiment described, the difference being in the electronic 
version of the ballot. To use these display types, instead of 
the EAS 60 producing a graphical ballot overlay (GBO) 65, 
ASCII text would be created for the display with switch 
positions associated with the touch screen switch matrix. 

Another alternative embodiment would include a voting 
tablet that is non-folding with a ridge panel and has a 
separate storage case. This variation would primarily only 
impact transportation and storage. 

The voting tablet 56 includes of a matrix 99 of LED 
illuminated membrane switches 100 (tablet switches). When 
the ballot overlay 65 is placed on top of the voting tablet 56, 
graphical marks on the ballot overlay 65 are aligned with a 
particular set of tablet switches 100. To make a selection, the 
voter presses the graphical mark corresponding to the selec- 
tion and the underiying switch ICO is activated. This acti- 
vates an LED 102 associated with that particular switch 100 
which, in turn, back lights the graphical mark selected. 

The tablet switches 100 are not regularly spaced, but have 
gaps in the matrix with some columns and rows completely 
omitted. An analysis of the probable layout of the ballot 
types indicate that there are certain columns, rows, and 
individual switches in the matrix that have a high probability 
of never being active for an election. Removal of these 
switches reduces the cost of producing the voting tablet 56 
while increasing the mean-time-betwecn-failure (MTBF) of 
the tablet 56 and maintaining a high degree of flexibility. 

The electrical configuration of the voting tablet 56 houses 
the majority of the electronics in the voting tablet control 
bank (VTCB) 98. The control bank 98 is electrically con- 
nected to the main voting tablet 56 through flex or conven- 
tional cabling. 

The voting tablet control bank (VTCB) 98 includes two 
shde-out sections along the bottom part of the voting tablet 
56 and the two sections are coincident with their respective 
halves of the voting tablet 56. The VTCB 98 is hinged along 
the bottom edge of the voting tablet 56 so that it swings 
outwardly from the inclined tablet and comes to rest on the 
bottom of the tablet sidewall. The width of the VTCB 98 can 
range from two to ten inches depending on the desired 
control and communication methods therein. The VTCB 98 
is split in two pieces to facilitate the folding tablet 56. A first 
half 103 houses a microprocessor 104, memory, and related 
circuitry and the interface to the TNC 50 while the upper 
surface of the first half 103 presented to the voter supporLs 
a keyboard 106 for write-in entry. The other half 108 is used 
for the "Cast Ballot" button 84 and a display 110. 

In the present invention, the width of the VTCB 98 is 
approximately four inches and presents the "Cast Ballot" 
button 84, the display 110, and the full alphanumeric key- 
board 106. The "Cast Ballot" button 84 is well marked and 
set off by itself and is used by the voter to finalize his vote 
and have it reco/ded by the voting system. In addition to the 
voting tablet 56 going blank when the voter presses the 
"Cast Ballot" button 84, an audible tone is emitted by the 
tablet 56 further indicating that the vote has been cast. Prior 
lo pressing the "Cast Ballot" button 84, as the voter makes 
selections within a contest, the large-format, electronic. 
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ilai-panel display 110, or LCD screen, displays the coniesi in selections and the other for casting the ballot. 'Ilie two 

one of a plurality of alternate languages as selected by the switches 114 are plugged into an adapter cable that accepts 

TNC 50. The voting tablet display 110 can accommodate an two Vs" monaural phono jacks at one end and converts the 

average size initiative or referendum. This allows those four contacts into three with the other end of the cable 

measures to be displayed ma language other than that which 5 terminating ai a Vs" male stereo phono jack. The cable 

IS prmted on the ballot overlay 65. If no foreign language is combines two contacts into a common ground for the two 

required or requested, the current active contest is displayed s^i^^hes 114. The Va" male stereo phono jack of the adapter 

in Enghsh. The voting lab et display 110 is also used for the ^^^^^ ^^^^ -^^^ ^ g J 

public counters that are tablet specific and appear in the p 1 _ u fr -ru . . c ,u ^^r-r. wm r 

voting tablet display 110. Public counters are required bv ^^"^'^^ "^'^^^"S half. The contacts of »he VTCB Vs'' female 

some jurisdictions and if so, a number is displayed that i's T^"" J'^*' ^"^^ purposes. The first, is to sense 

identified as the number of voters that have voted on that ^^^^ ^ '^^^^^ ^0 ^^'^ ^^^^^^ stereo 

voting tablet 56 during the present election. Another use for P^°"° J^'^^ ^^^^^^ ^^n^e switch activations by 

the voting tablet display 110 is to echo voter write-in Ihe jelly switches 114. A simple grounding technique accom- 

seleclions and to provide guidance and help messages Pushes the insert sense whereby when the jack is inserted, 

should the voter request them. the jack completes a circuit path to ground which can be 

Many jurisdictions require that write-in selections be digital sensed by interface electronics. This technique does 

olTered for all candidate races. To enter a write-in vote, the not interfere with sense activation and the switches then 

voter selects the write-in option within a particular race. I'he perform normally by completing a current path when acti- 

display 110 flashes a message that may read "enter write-in vatcd, 

vote" or the like and the voter can use the keyboard 106 to 20 Jelly switches 114, such as one manufactured by TASII 

enter the name of the write-in candidate. When the voter Inc., of Ajax, Ontario, Canada, under model name "Button 

selects the first character, the display 110 is updated to read Buddy" and the adapter cables, model number 4342, also 

"Press enter when done or resume voting" and the first manufactured by TASH Inc., are readily available on the 

selected character is also displayed. With each keystroke, the commercial market. 

display 110 is updated until the voter is finished and either 25 To further support access to persons with disabilities, the 

presses the enter key on the keyboard 106 or makes another present invention accommodates blind persons. Next to the 

selection on the ballot. In each case, the candidate written in jelly switch jack is a headphone jack where common mon- 

for that race is stored in temporary memory with the other aural headphones 116 are plugged into the VTCB 98 through 

selections the voter has made. The voter is still free to the RST 112. A text-to-speech converter transforms the text 

change his/her selection even though a write-in has been 30 echo on the LCD screen 110 of the voting tablet 56 to speech 

entered for that race. Should the voter re-activate the write- for the headphones 116, with a D/A converter or a pulse 

in switch in a race where a candidate has been entered, the width modulator. The audio output operates on the same 

display 110 will show the name of the written-in candidate. scanning algorithm as previously described and simply adds 

The voter can erase the current name and enter a new one or the text-to-speech converter output. The conversion from 

select a registered candidate for that race that will erase the 35 text-to-speech is a well developed technology with several 

previously written-in candidate. commercial sources for such products, such as the one 

The VTCB 98 has an electronic connector located at the manufactured by Dialogic Corporation, of Parsippany, NJ., 

front corner that allows an external device to be connected, under product name "TextTalk"™. The software routine has 

upon request or as a standard feature, to provide input access access to the text that is displayed on the Voting Tablet LCD 

for disabled voters, through a remote selection terminal 40 and uses this information to convert the text into compre- 

(RST) 112. When the RST 112 is plugged in, activation of hensible speech. The converted signal is delivered to the 

contest switches can be accomplished remotely through headphone jack, and then on to the ear piece(s) of the 

various means that will enable persons with disabilities to headphones. Plugging the headphones 116 into the female 

vote unassisted. When the RST 112 is connected to the stereo phono jack activates the text-to-speech function and 

voting tablet control bank, contest lights start automatically 45 the jelly switches 114 activate the scanning routine. The jelly 

sequencing through each race on the ballot and when a light switches 114 have Braille labels applied to the top surface 

is active and the voter desires that selection, the RST 112 that identify the function of the switches. As the scanning 

receives a stimulus from the voter and the selection is made. routine illuminates a selection within a race, the text-to- 

The sequencing would continue until all selections have speech converter supplies the audio equivalent through the 

been made with a second input from the RST 112 casting the 50 headphones 116. Selections are made by activating the 

ballot. The RST 112 can employ any of several means for proper jelly switch 114 until all selections have been made, 

sensing a stimulus from the disabled voter including a Casting the ballot can occur any time by activating the cast 

finger-operated switch, a foot-operated switch, a head- ballot jelly switch. 

operated switch, or a breath-operated switch, or other known The process by which the RST 112 works together with 

means for receiving inputs from disabled persons. 55 the voting tablet 56 to scan through the ballot will now be 

While other switch types as mentioned above can be used described, with reference to FIG. 30 (with reference num- 

in the RST 112, a popular switch known as a "jelly switch" bers for the process steps in parentheses). The RST scanning 

114 is the preferred switch type. Jelly switches 114 arc routine starts with the microprocessor 104 polhng the RST 

typically round, three to sue inches in diameter and one-half sense logic circuit as part of its polling of the voting tablet 

to two inches thick. By pressing anywhere on the large target 60 switch matrix 99, after the voting tablet 56 is armed for 

top surface, the switch 114 is activated. Electrically, the voting. li continues polling until either it senses (270) the 

switch 114 is a simple momentary contact ideally suited for insertion of the switch 114 into the RST 112 or a switch 

the scanning routine of the voting tablet 56. The jelly switch actuation on the voting tablet 56. If a voting tablet switch 

114 comes standard with a '/s" monaural phono jack which actuation is detected first, the.i the RST sense circuit is no 

presents two contacts on the phono jack. 65 longer polled and voting continues from the voting tablet 56. 

The preferred embodiment of the present invention uses If the microprocessor 104 delects a switch insertion into the 

two jelly switches 114 in the RST 112, one for making RST 112, the .scanning routine begins sequencing (272) the 
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first race on the voting tablet 56. Sequencing a race involves 
illuminating the first selection within the race, and momen- 
tarily pausing long enough for the voter to actuate the jelly 
switch 114. After the pause, if no jelly switch actuation is 
sensed (274), the next selection within the race is illumi- 
nated (272) followed by a pause. This continues until all 
selections have been illuminated. If all selections have been 
illuminated and no selection sensed, the sequencing starts 
back with the first selection. This pattern repeats for three to 
five cycles and if no selection is made during that time, the 
routine moves the sequencing to the next race (276). This is 
a "time-out" condition which allows the voter to exit that 
particular race without making a selection. 

If at any lime during the sequencing of a race a jelly 
switch actuation is detected, the sequencing routine lights 
the currently illuminated selection solidly and moves to the 
next race and begins the selection sequencing (276). As the 
next race is sequencing, the voter is able to visually verify 
their selection in the previous race. This process continues 
until all races have been sequenced, or the cast ballot switch 
is actuated (278). Once the cast ballot switch is actuated, the 
selections made up to that point become the voter's ballot 
image and any races where no selection has been made 
become a "no vote". 

Once all races have been sequenced and the cast ballot 
switch has not been actuated, the scanning routine returns to 
the first race and continues sequencing (272). If a selection 
had been previously made for a race, as visually indicated by 
the solidly-lit LED, that LED remains illuminated indicating 
its selection but the other selections continue to be 
sequenced giving the voter an opportunity to change their 
vote. 

The voter is able to scroll through the races by actuating 
the jelly switch 114 and holding it down. The sense circuit 
acknowledges the difference been a momentary actuation 
and a continuous actuation and sequences at a similar pace 
through the races, illuminating the race lights indicating the 
active race. 

This same sequencing process is used if the sense circuit 
detects headphones 116. When a selection within a race is 
illuminated, the text-to-speech converter output the audio 
equivalent of the selection. 
Visual Vote Verification (V^)j-j^, 

The present invention provides for an independent means 
of producing and recording the ballot image. A proposed 
means for producing the independent ballot image is accom- 
plished by monitoring the current or voltage to the LED 102 
associated with each switch 100 on the voting tablet mem- 
brane switch matrix 99. The voting tablet 56 acknowledges 
the switch activation by issuing a command that turns on the 
corresponding switch LED 102, indicating to the voter that 
the selection has been made. Monitoring the current or 
voltage supplied to the LED 102 can be accomplished 
through several dilTerent approaches, three of which are 
described below. 

The first approach, shown in FIG. 16, uses a common 
integrated circuit (IC), known as a comparator 120. The 
comparator 120 determines if the LED 102 is off or on by 
measuring the vohage on one side of a current sense resistor 
122 and comparing it to a fixed reference voltage. The sense 
resistor 122 is connected in series between the LED driver 
and the LED 102. One side of the sense resistor 122 is also 
connected to the negative input of the comparator 120. The 
positive input of the comparator 120 is connected to the 
mid-point of a voltage divider network made with two 
resistors connected in series. The voltage at the mid-point of 
the divider network is determined by the value of the two 
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resistors. In a possible embodiment, the positive input of the 
comparator 120 is set to 0.9 of the supply voltage. 

In operation, if the LED 102 is off, no current flows 
through the sense resistor 122 and the negative input of the 
5 comparator 120 is equal to the supply voltage and the output 
of the comparator 120 is a logic zero. When the LED 102 is 
turned on, current flows through the sense resistor 122. The 
sense resistor 122 is selected so that the amount of current 
that flows through it when the LED 102 is on multiplied by 

10 its resistance is less than 0.9 of the supply voltage. For 
example, if the current through the LED 102 is 10 mA and 
the supply voltage is 5 Volts, the sense resistor 122 could be 
selected to be 400 ohms. In this example, the negative input 
of the comparator 120 would be 4 Volts when the LED 102 

15 is on. The output of the comparator 120 would then be a 
logic one. This circuit can thus detect an open circuit LED 
102 or LED driver. If either of these conditions exist, no 
current will flow through the LED 102 when the micropro- 
cessor 104 has commanded it to be on. The comparator 120 

20 will be logic zero and thus the microprocessor 104 could 
sense this failure. This circuit will also detect a shorted LED 
driver. If the driver is shorted, current will always flow 
through the LED 102. If the microprocessor 104 commands 
the LED 102 to be off, current would be flowing through the 

25 LED 102, The output of the comparator 120 will be a logic 
one and thus the microprocessor 104 could sense this failure. 

The logic state of the comparator 120 is then communi- 
cated to the microprocessor 104 through a series of multi- 
plexors and buffers to be analyzed. The output of the 

30 comparator 120 is wired to a buffer IC 124 with output 
control. The outputs of the buffer 124 are then fed to a 
multiplexor IC 126 with output select. The output of the 
multiple xor(s) 126 is then connected to an appropriate input 
of the microprocessor 104. The output control and output 

35 select lines of the buffers 124 and multiplexors 126, 
respectively, are under microprocessor control so that any 
one of the LEDs 102 can be monitored at any given time. 

The output control of the buffer 124, plus the output select 
of the multiplexors 126, allows each LED 102 in the 

40 membrane switch matrix 99 to have its own specific address 
with an associated LED position in the matrix 99. Therefore, 
the microprocessor 104 loads the address bus with the 
address of a specific LED 102, which in turn, configures the 
buffers 124 and multiplexors 126 to pass the results of the 

45 corresponding LED comparator 120 to the microprocessor 
104. A simple software routine that utilizes the list of LED 
addresses can quickly accumulate the stale of the compara- 
tors 120. Once the state of the comparators 120 is known, the 
ballot image can be constructed using the LED position 

50 information. 

A second method for providing a separate recording of the 
cast ballot is implemented using a multiplexed LED array, as 
shown in FIG. 17. A multiplexed LED array or matrix 130 
includes a matrix of LEDs that have their anodes wired 

55 together, forming a **row," and the LED cathodes wired 
together, forming "columns." Connected to each row and 
column are driver ICs. Row and column drivers are on at 
different points in time and determine which LEDs are 
illuminated. When an LED is commanded to be on, the row 

60 driver and column driver are activated that are connected to 
the anode and cathode respectively, of the LED that is to be 
turned on. The LED does not have to be driven 100% of the 
time for it to appear to be on, for the human eye. This allows 
the driver ICs to share time when they are driving so that the 

65 whole matrix 130 of LEDs may be serviced. A service cycle 
is determined by the clock rale supphed to the driver ICs and 
during one time period, each row and column driver pair is 
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activated once so (hat ihe LEDs that arc supposed to be on 
are pulsed. This is a common technique used tor 7 -segment 
LCD displays, commercially available from a variety of 
sources. 

With the LEDs connected in this manner for turning them 
on and off, each row and column are further connected to 
analog row and column multiplexors 132 and 133. The 
outputs of the row and column multiplexors 132 and 133 are 
connected to the input of a common instrumentation ampli- 
fier IC 134. The row signal is connected to the positive input 
of the amplifier 134 and the column signal is connected to 
the negative input. The output of the amplifier 134 is the 
dilTerence in voltage of input ailumn and row .signals. The 
output of the amplifier is then digitized by an analog to 
digital converter (A/D) 136 and the results can be read by the 
microprocessor 104. 

As the LED array 130 goes through a service cycle, the 
analog multiplexors 132 and 133 are set to pass through the 
desired column and row signals. The microprocessor 104 is 
interrupted at the appropriate time to sample a selected LED 
voltage using the A/D 136. The voltage is read into the 
microprocessor 104 arid analyzed. Microprocessor code sets 
a predetermined range for the LED voltage and analyzes the 
voltage with respect to the range. If the voltage falls within 
the predetermined range, the LED drivers are on. An 
example range would be L5V to 3.2V. If the voltage is 
outside this range, the microprocessor 104 could determine 
that a failure exists. 

The failures this circuit can detect include: an open LED; 
a shorted LED; and a shorted row or column driver. A 
resistor can be added across the inputs of the instrumentation 
amplifier to reduce errors from leakage currents in the 
drivers. This configuration would also allow the micropro- 
cessor 104 to determine if a column or row driver failed in 
an open condition. 

A third method (not shown) for providing a separate 
recording of the cast ballot is to use an emitter/detector pair 
instead of an LED. In this Instance, when the emitter 
(synonymous with the LED above) is activated, the detector 
portion of the emitter/detector pair seases the emitter is 
active by detecting radiated light reflecting off the back of 
the ballot overlay surface. Emitter/detector pair technology 
is advanced enough to the point at which, given the geom- 
etry of the placement of emitter/detector pairs, adjacent pairs 
will not erroneously detect the wrong emitter of the voting 
tablet 56. To overcome ambient light conditions, the emitter 
is pulsed and the ambient light signal is electronically 
filtered out. This monitoring method requires processing of 
analog signals into a digital format and adds a great deal of 
microprocessor overhead. 

Employing one of these three methods in the voting tablet 
56 further provides a means to functionally test each voting 
tablet 56 while it remains stored in a warehouse between 
elections. Voting systems to date are required to be set up to 
have their functionality tested. The present invention can be 
left in its transport configuration and the electronics tested 
with verification that all the vote selection lights (LEDs or 
emitter/detector pairs) illuminate. This eliminates the logis- 
tical requirement of setting up the system for testing, saving 
jurisdictions considerable time and money when performing 
quarterly or pre-election tests of the type used to verify 
equipment performance. 
The Intelligent Ballot 

The voting tablet 56 has means to read a machine readable 
code printed on the ballot overlay 65 when the ballot is 
installed in the tablet 56. The machine readable code can be 
either a conventional bar-code, or a two-dimensional (2-D) 
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symbology that has one hundred times more information 
carrying capability. Bar codes and 2-D symbologies provide 
information through the use of coded symbols that contain 
light and dark areas (typically black and white). When code 

5 scanners "read" the symbols, they are able to distinguish the 
light and dark areas and transmit this to decoder circuitry 
that extracts the information contained in the symbol. There 
are many published bar-code standards and the codes vary in 
the manner which the light and dark areas are printed. 

10 Symbol "readers", or scanners, are typically laser-based or 
utilize charge -coup led devices (CCDs) to read the symbol. 
The 2-D code is called a portable data file (PDF) and 
functions as a high-density, high-capacity printed data file 
that is accurately read by compact CCD imagers. One 

15 standard symbology protocol is PDF417 which is supported 
as an industry standard. The current data capacity of a 
PDF417 symbol is approximately 1.1 kilobytes and is 
expected to increase. PDF symbology is essentially a paper- 
based computer memory that can be written once and read 

20 many times (a paper-based WORM). The printed symbols 
are encrypted so that security is maintained. Data can be 
retrieved even with fifty percent of the symbol damaged and 
uses self -verifying algorithms to maintain data integrity. 
The present invention utilizes a machine readable code 

25 that is printed on the graphical ballot overlay 65 and is read 
by the voting tablet 56. Ilie preferred embodiment employs 
a CCD 140 (or a bar code scanner) that is integrated in the 
frame of the voting tablet 56 and is located in the lower right 
corner thereof, as shown in FIGS. 13 and 14. The CCD or 

30 scanner 140 extends from the lower right comer approxi- 
mately IW up the side and 2*/^" along the base. The height 
of the CCD 140 is the same height of the voting tablet frame 
so that the CCD 140 does not protrude above the edge of the 
frame. The CCD housing is raised a maximum of ^4" off the 

35 surface of the voting tablet 56 providing clearance so that the 
graphical ballot overiay (GBO) 65 can slide underneath the 
CCD 140. The machine readable code is printed on the ballot 
overiay 65 so that when the ballot overlay 65 is slid under 
the CCD 140, the ballot butts up against the sides of the 

40 voting tablet to position the code properly under the CCD 
140. 

In the preferred embodiment, the CCD 140 integrated in 
the voting tablet 56 uses a CCD scan module, such as 
manufactured by ID Technologies, as model number 

45 WCR7400-401 (or a bar code module as manufactured by 
PSC Inc., as model number DMOOOGP). The CCD module 
is mounted in the housing provided by the voting tablet 
frame and the scanning element faces downward toward the 
surface of the tablet 56. Electronic cabling routes into the 

50 body of the voting tablet 56 and combines with other cabhng 
and continues to the voting tablet control bank (VTCB) 98. 
l^e CCD module cable connects to the circuit board in the 
VTCB 9« where the signals transmitted from the CCD 
module are routed to a decoder IC. The decoder IC trans- 

55 forms the signals from the CCD module or bar code scanner 
into digital information (if not already) which are made 
available to the data bus in the VTCB 98. Since the scanning 
and decoding rates are relatively low for the technology, 
decoding of the scanned images can be performed in soft- 

60 ware rather than by a dedicated IC. At this point, the symbol 
information is just a data word and remains to decrypted or 
interpreted which occurs under TNC control. 

Implementing this aspect in the present invention begins 
during the ballot preparation stage of the election when the 

65 graphic output files are produced. Along with the electronic 
version, the EAS 60 generates an encrypted PDF or a 
proprietary bar code symbol. The symbol is created simul- 
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taneous to the electronic versioD and ls imbedded in the Power to the voting tablet 56 is delivered unregulated and is 

graphic output file. When the graphic output iile is printed on then regulated by the voting tablet and distributed through- 

the ballot overlay 65, the symbol is also printed, located in out the device. 

positiontobcreadby the voting tablet CCD 140 (or bar code This allows the cable from one voting tablet 56 to be 

scanner). The symbol can be printed back of the ballot 5 connected to the next voting tablet 56 in the precinct with the 

overlay 65 which would require the CCD 140 to be mounted end voting tablet 56 either connected to the TNC 50 or, fitted 

in the body of the tablet 56 rather than suspended over it, with a power conversion adapter and connected to a wall 

The preferred method is for the code to appear on the same socket for power. Further, the voting tablets 56 may receive 

side as the ballot graphics to avoid double-sided printing. power from a portable power source, such as a battery or 

When the GBO 65 is installed in the voting tablet 56, the lo portable generator. When the coramunicalion interface is by 

symbol is aligned with the read window of the scanner 140. direct electrical connection to the TNC 50, the wireless 

Scanner technology is such that with the symbol stationary, communication means is disabled by the TNC 50. Should 

the scanning mechanism optically reads the symbol when the voting tablet 56 not receive a voting tablet cable 

triggered by the TNC firmware, reading the data contained connection, but receives power, the voting tablet 56 expects 

therein. Once the symbol is decoded, the voting tablet 56 is to receive a wireless communication. The TNC 50 transmits 

then transmits the data word to the TNC 50. a coded wireless message to the voting tablet 56 to set it up 

When using the 2-D symbology, the TNC 50 decodes the for the wireless mode. All subsequent communications 

encrypted data word using data from the symbol data word occur via wireles.- transmission. 

and a pre-programmed algorithm contained in the TNC 50. The voting table' :6 remain networked to receive power. 
Once the GBO 65 is verified as authentic from the decoded 20 at a minimum, ex -n in the case of certain distributed 
data, the TNC 50 loads the electronic version of the ballot portable power sources. The advantage of providing wire- 
extracted from the 2-D symbol data. The 2-D symbol less means for data communication is found in the fact that 
contains all information necessary to electronically config- when the equipment is set up in the precinct, the TNC 50 and 
ure the voting tablet 56. Use of the 2-D code eliminates the administration functions of the election are physically sepa- 
need to pre-program the MMU 58 prior to the election, 25 rated from the voting area. The wireless configuration may 
greatly simplifying pre-election preparation. However, the eliminate the requirement of routing a cable on the floor 
imaging electronics required for 2-D codes are much more through high traffic areas which can create a hazard to both 
expensive and may not be cost effective given current voting the voters and to the electrical interface between the TNC 50 
system economics. With bar code imaging instead of 2-D and voting tablet 56. 
codes, the information stored in the MMU 58 contains a 30 Privacy Enclosure 

record of all possible ballot types, one of which is pointed The privacy enclosure 54 is used in conjunction with a 

to by the particular bar code. voting tablet to form a voting booth station, as shown in 

Bar code imaging is currently more cost effective and also FIGS. 18-20. The privacy enclosure 54 includes hinged 
provides significant advantage in voting systems. When panels 150 supported by four legs 152. The legs 152 support 
using a bar code printed on the GBO 65, the data is 35 the panels 150 al approximately waist height and the panels 
transmitted to the TNC 50 where it interprets the proprietary 150 extend to approximately shoulder height. The exact 
code. The proprietary code is a non-standard symbology dimensions are determined by using a combination of 
which can not be read by off-the-shelf bar code readers human factors engineering data, commonly found in refer- 
commonly available in the market. The proprietary code ence books (such as Bodyspace-Anthropometry, 
requires a custom algorithm that is embedded in the decode 40 Ergonomics, and the Design of Work, Stephan Pleasant', 
IC, or software algorithm, that converts the scanner element Taylor & Francis, 2d edition 1996, and Human Engineering 
information into digital data. Without the algorithm, the Guide to Equipment Design, Joint Anny-Navy-Air Force 
scanner element information can not be converted. Given Steering Committee, McGraw-Hill Book Company, 1954), 
proper conversion and transmission to the TNC 50, the data and actual line of sight to the voting tablet. Privacy provided 
is interpreted and becomes a "pointer" to data contained in 45 by the privacy enclosure 54 is sufi5cient so that a male of 
the MMU 58. The MMU 58 contains the electronic version height in the 95th percentile standing at a distance of two 
of all the possible graphical ballot overlays (ballot types) feet from the privacy enclosure 54 cannot see the voting 
that are allowed in the election. Each ballot type is identified tablet. The lower dimension of the privacy enclosure 54 is 
by valid bar code data. The valid bar code as generated by derived from the height of the keyboard 106 which is set at 
reading the code from the ballot then points to the vahd 50 the optimal height for a standing female of height in the 50th 
ballot type stored in the MMU 58. If no match occurs, the percentile. While this keyboard height may be optimal for a 
code is read from the voting tablet 56 again and if still no 50th percentile female, it will adequately accommodate 
niatch occurs, an error message is displayed on the TNC voters of other heighLs. This means that the top edge of the 
display 78 and the operation ceases until the problem is voting tablet 56 is fifty-five inches off the ground. Placing 
corrected. When the bar code read from the voting tablet 55 the keyboard 106 at this height means that even a female of 
matches a ballot type stored in the MMU 58, the TNC 50 height in the 5th percentile cannot see the voting tablet 56 
loads the electronic version of the ballot into the TNC under the privacy enclosure 54. An angle of sixty-five 
FLASH. One advantage of using the bar coded graphical degrees from horizontal was found to be preferable for the 
ballot overlay 65 is that it eliminates the requirement to angle of the voting tablet 56. The panels 150 arc constructed 
pre-program a specific MMU 58 for a specific ballot, making 60 of metallic frame, typically aluminum, with the panel 150 
all equipment used in conducting an election generic. typically being thin plastic sheet material or upholstered 
Precinct Network with fabric. The advantage of the plastic sheet material is 

The communication interface between the voting tablet 56 found in the durability and ease of maintenance and has the 

and the TNC 50 uses either a cable or wireless link. The capabihty to cost effectively include custom printed indicia 

power is either supplied by a permanently attached cable, or 65 on the panels 150 for a particular jurisdiction, 

may be supplied locally in a distributed fashion. ITie CAN A key advantage of the present invention is the portability 

protocol supports integrated power transmission with data. of the system components. To support this advantage, the 
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privacy enclosure 54 collapses into a lighlwcighl, 
manageable, form factor such that the average poll worker 
can easily lift, transport, and set it up. The panels 150 of the 
enclosure 54, at a minimum, are hinged at each of the four 
corners. The hinge pattern is such that the panels fold on like 
surfaces (inside to inside, outside to outside) in an accordion 
fashion. The resulting form factor of the folded panels 150 
is that of a thin suitcase with the outermost panels and the 
metallic frame comprising the exterior of the transportable 
configuration. This allows the panels 150 to function as the 
outer shell, or container, of the privacy enclosure 54 when in 
the transportable configuration. The legs of the privacy 
enclosure 54 retract into the vertical portion of its associated 
panel frame and lock into the retracted position when placed 
in the transportable configuration. When folded, a handle 
and latching mechanism are provided in the appropriate 
position for carrying the collapsed enclosure 54 and are 
unobtrasive when the enclosure 54 is in the deployed 
configuration (back side of the enclosure). 

To deploy the privacy enclosure 54, the legs 152 are 
extended from their locked, retracted position within the 
panel frame and are locked in the extended position. The 
legs 152 are located at each of the four corners of the 
rectangular privacy enclosure 54 and are set so that a 
minimum of hinge points exists between the legs 152 as 
viewed from the side of the enclosure 54. The enclosure 54 
is able to maintain upright stability prior to the hinges being 
fully extended, which aids in the ease of set up. As the 
corners of the enclosure 54 are positioned into ninety -degree 
angles, locking struts, or pins, located at the bottom portion 
of the rear panel frame insert diagonally across the back two 
corners of the enclosure 54. The angle of the strut is 
determined by the length of the strut and the pin location on 
the back and side panels 150. These two attributes are a 
function of the enclosure dimensions and the restrictions of 
the transportation configuration. When locked into position, 
the struts firmly secure the back and two sides of the 
enclosure 54 at ninety-degree angles. The front panel of the 
enclosure 54 provides access to the interior of the enclosure 
54, employing a hinge method such that an access panel 154 
is closed when in the rest position and requiring application 
of force to open. Preferably, the access panel 154 is a single 
panel that opens outwardly and is compliant with the 
requirements of the ADA. 

However, the access panel 154 may be made up of two 
sections that operate similarly to cafe-style doors. 

The interior of the enclosure 54 provides means for 
mounting the voting tablet 56 to the three interior panels 150 
(two sides and the back). Positioning studs coupled with 
locking means comprise the mounting method. The posi- 
tioning studs support the voting tablet 56 at points on 
bottom-frame members on each side panel 150, extended 
from the back two comers of the enclosure 54. The top of the 
voting tablet 56 rests against the vertical frame members of 
the back panel 150. The privacy enclosure 54 includes 
means at these four locations to secure and lock the voting 
tablet 56 in this position such that the securing and locking 
means prevents tampering and provides additional structural 
stabihty to the privacy enclosure 54. The angle of the voting 
tablet 56, as established by the mounting and locking means 
is that which is optimal for the presentation of a large group 
display and observer arrangements according to human 
factors engineering data. The leg end that contacts the floor 
provides an automatic leveling means to account for irregu- 
lar floor surfaces to further increase the privacy enclosure 54 
stability, 

nt positioning studs in the bottom side panels 150 of the 
enclosure further fix the position of the voting tablet 56 such 
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that when the voting tablet control bank (VTCB) 98 is folded 
out and placed in the deployed position, bottom-frame 
members provide means for locking the VTCB 98 in place. 
In the area of the voting tablet 56 where the VTCB 98 

5 unfolds or slides, the tablet 56 has a suspended center 
storage area that stores the light fixture. The light fixture is 
permanently cabled to the voting tablet 56 and is removed 
from its storage pocket and hung from the top of the back 
panel 150. The cable is routed over the side then up the back 

10 of the voting tablet 56, through the opening between the 
tablet 56 and back panel 150 of the enclosure 54. The light 
fixture is then hung in the center of the back panel 150, 
shining down on the voting tablet 56. The lights are posi- 
tioned in the frame such that the angle of incidence on the 

15 voting tablet 56 is optimized for viewing according to 
human factors engineering data, including minimizing glare. 
The privacy enclosure 54 is designed to provide privacy and 
highlight the voting tablet 56. 
An alternative version of the privacy enclosure 54 would 

20 include a table top version with side panels and door(s). 
Such a privacy enclosure would sit on a table in the polhng 
place. Another alternative would be to mount or hang the 
voting tablet from a wall with privacy panels extending from 
the wall also to form a privacy enclosure. 

25 Operation flTiroughout the Year) 

'llie system 40 manages elections and election data year 
round and the EAS 60 functions as the central data reposi- 
tory of all of the information required to conduct an election. 
While in currently available voting systems, the various 

30 aspects of elections are separate and distributed, the system 
of the present invention brings these pieces together to 
provide greater efficiency, accuracy and cost savings for 
operation. Election day is the major event but election 
preparation is year round. 

35 Conducting an Election 

To prepare for an election, information is input to the EAS 
60 that is specific to an upcoming election. The integrated 
EAS program uses this and the other supporting information 
that has been maintained year round in the other databases 

40 in order to disseminate the election specific information in 
the correct manner through the jurisdiction. Election ofiG- 
cials input the data for the upcoming election in the form of 
political parties, candidate races, referendums, contests, and 
judicial issues. This information, coupled with the other 

45 necessary election-related data previously stored by the EAS 
60, produces the plethora of information required to stage an 
election. Output from the EAS 60 in preparing for an 
election includes but is not limited to: registered voter 
eligibility logs with bar code designation; equipment lists 

50 that assign the number of each type of voting equipment to 
precincts 48; and a variety of ballot types that correspond to 
correct contests for each precinct 48. Each ballot type is 
output by the EAS 60 in three forms: electronic data; 
graphical ballot overlay (GBO) files; and portable data files 

55 (PDF) or bar code designation. 

An MMU 58 is installed in each TNC 50 at election 
headquaneis 44 or at the precinct 48 and the TNC 50 
uploads the information stored in the MMU 58 into the 
TNC's FLASH memory so that the TNC 50 contains the 

60 necessar;. information to conduct an election at a particular 
precinct 48. The present invention uses FLASH memory in 
each of three precinct electronic components. FLASH 
memory technology has the ability to reliably store data in 
a permanent fashion, similar to read only memory (ROM), 

65 where no power is required to maintain the data stored 
therein. ITie use of FLASH memory specifically eliminates 
the need for the MMU 58 to rely on batteries to maintain the 
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Stored data when the election is completed. This is particu- 
larly important when the MMU 58 is transporting ballot 
images from the precinct 48 to the election headquarters 44. 
The MMU 58 is not disposed of, nor requires servicing 
between elections, as in prior art. 5 

The graphical ballot overlay (GBO) files from the EAS 60 
arc used to drive the ballot production device 65, such as a 
large formal pen plotter, an electrostatic plotter, a laser 
printers, or other suitable equipment and produces the 
graphical ballot overlay (GBO) 65. The GBO 65 contains lO 
printed representations of the subject matter of the election. 
It represents the ballot as laid out by the EAS 60 and presents 
the election subject matter in an organized, readable fashion 
while adhering to the jurisdiction's legal requirements. The 
GBO 65 can be printed in one of any number of languages is 
and segmented as appropriate for the type of election being 
conducted. The overlay 65 is installed on the voting tablets 
56 in the voting stations 52 prior to the election by election 
officials at the precinct 48 and the GBO 65 is what the voter 
sees to direct him/her to the possible selections in the voting 20 
station 52. The GBO 65 also has a machine readable code 
printed on it that is read by the voting tablet 56. 

The GBO 65 is divided by contests and races with each 
highlighted by a contest light. The contest light indicates 
whether a voter has voted for that contest. Once a voter 25 
makes a selection within the contest, the race light is 
extinguished. The race lights are intended to aid the voter in 
making sure they vote for all eligible contests. 

The machine readable code is either a bar code that 
identifies the ballot type, serial number and security data or 30 
a portable data files (PDF) that, when decoded, contains the 
electronic version of the ballot. The capability to incorporate 
the electronic configuration data as a printed code on the 
ballot eliminates a great deal of logistical requirements of 
previous voting systems. Eliminated is the risk of assigned 35 
equipment and data files going to the wrong precinct 48. 
Election oflBcials no longer have to assign, manage and 
monitor delivery of specific equipment to a specific precinct 
48. All equipment and transported data files are generic to 
the election with the configuration key incorporated with the 40 
ballot, the variable of the election. 
Absentee Voting 

Absentee ballots are widely used in elections across the 
country to allow registered voters to cast their ballots away 
from the precinct polling place. Many different circum- 45 
stances can cause a certain percentage of voters to be away 
from their precinct polling place on election day. 

An absentee ballot 180 (FIG. 26) is delivered to the voter 
either by mail or by the voter picking it up from the 
jurisdiction headquarters. The ballot is typically returned by so 
mail at some time prior to the close of the election, depend- 
ing on local rules. Procedures vary with jurisdiction on how 
absentee ballots are processed once the ballot is returned. At 
some point the ballots are counted and added to the totals 
from election day. Some jurisdictions require that the absen- 55 
tee ballots be counted at the precinct polling place that the 
absentee voter is affiliated with, then added to the precinct 
polling place totals, while others simply add them at head- 
quarters 44 regardless of precinct aflBliation. 

The absentee ballot system should provide all of the 60 
secrecy, privacy, and security afforded a ballot cast at the 
precinct polling place. This may require certain standardized 
procedures at the headquarters 44 since the ballots have to 
be handled by election officials when absentee ballots are 
returned by mail. 65 

'Inhere are a variety of absentee ballot systems used 
currently. The majority of the systems use punch cards or 



optical scan ballots. The juri.sciictions that use such equip- 
ment include those that also use punch cards and optical scan 
equipment in their precinct polling places. But there are also 
jurisdictions that use other equipment in their precincts 48. 
Inhere have been several proposed absentee systems that 
include removing a bar coded sticker representing the vot- 
er's selection and placing it on the return portion of the 
absentee ballot. 

The present invention utilizes a variation in optical scan- 
ning that possesses several advantages over previous absen- 
tee systems which will become apparent as described below. 
The absentee system described herein ts an integral part of 
the total system and, when used in conjunction with other 
aspects of the system, it provides additional advantages over 
other absentee systems when conducting an election. 
The Absentee Ballot 

The absentee ballot 180 includes two sheets of paper, 
including a top sheet 182 and a bottom sheet 184, as shown 
in FIG. 26. The top sheet 182 has a matrix of square, cut-out 
holes 186 in it similar to the voting tablet switch matrix 99 
to match the selection boxes as shown on the graphical ballot 
overiay (GBO) 65. There are some relief areas 188 around 
the perimeter of the top sheet 182 that exposes the bottom 
sheet. There are two types of top sheets, one with the holes 
spaced horizontally on approximately 2y4-inch centers and 
one with holes spaced on 5-inch centers. 'ITie 2y4-inch center 
holes are used for political and judicial races and the 5-inch 
centers are used for initiatives and referendums which 
contain a great deal of text. The bottom sheet 184 has no 
holes in it. The two sheets of paper 182 and 184 are held 
together on the vertical sides by perforated edges 190 such 
that when the edges 190 are removed, the two sheets 182 and 
184 are separated. When the absentee ballot 180 is printed, 
the graphical ballot overlay (GBO) 65 that is used for the 
voting tablet 56 is printed on the top sheet 182 such that the 
selections are aligned with the holes 186 in the top sheet 182 
of paper. The printed matter on the top sheet 182 of paper 
further includes printed graphics which indicate that the hole 
186 aligned with a particular selection is to be used to 
choose that selection. The appearance of the printed absen- 
tee ballot 180 is identical to the printed GBO 65 used in the 
precinct polling places during the election day, but is scaled 
down. Ballot rotation methods are supported as may be 
required by a jurisdiction and handled in an identical manner 
as with the precinct polling places. 

The bottom sheet 184 of the absentee ballot 180 is printed 
with a bar code 192 that has three data elements. The first 
data element includes the same information provided by the 
bar code on the GBO 65 for a precinct polling place voting 
tablet 56 but gives the ballot style instead of the ballot type. 
A ballot type is equivalent to what is printed on the GBO 65, 
while a ballot style is any possible subset thereof. In other 
words, each precinct 48 should have a single ballot type, but 
it may support any of a variety of ballot styles including only 
those races and issues for which the various voters in the 
precinct may be eligible to vote on. A second data element 
includes an encrypted numerical code for proving authen- 
ticity of the absentee ballot. A third data element includes a 
unique absentee ballot issue number. 
Absentee Ballot Targets 

Also printed on the bottom sheet are three graphical 
marks, called *' targets" 194. Two of the targets 194 are 
positioned along the left, vertical edge of the ballot with one 
of those and one additional target 194 being positioned along 
the lower edge. The targets 194 can include any of a variety 
of shapes with the most typical including a sofid center 
circular area and bounded by two concentric circles. 
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Through the center point of this are a set of perpendicular 
lines that extended just beyond the outer concentric circle. 
This colleclioD of graphics forms the target 194. 

Priming of the top and bottom sheets 182 and 184 of paper 
occurs simultaneously because the two sheets 182 and 184 
are attached together by the perforated edge 190. There are 
relief areas 188 cut out on the lop sheet 182 where the bar 
code 192 and targets 194 are printed on the bottom sheet 
184. 

An alternate ballot design includes a carbonless top sheet 
and a blank bottom sheet. By using a printing method that 
does not make an impression when printing, such as a laser 
printer, the top sheet may be printed with the GBO 65. The 
voter would then mark their selections on the top sheet and 
the carbon treated backside of the top side would transfer the 
voter's selections to the bottom sheet. The voter would then 
remove the perforated edges to separate the two sheets and 
return the bottom sheet to headquarters 44. This is a more 
cost-effective ballot style and is commonly used for billing 
statements for customers, 'lb prevent spurious marks from 
being made on the bottom sheet from accidental 
impressions, the carbon applied to the backside of the top 
sheet would be applied in the same matrix as the cut out 
boxes as described above. This will limit the possibility, for 
example, of making accidental marks by handhng of the 
ballot. 

Absentee Write-in Votes 

In jurisdictions that permit or require write-in votes, the 
absentee ballot 180 has a selection in the appropriate races 
labeled as "write-in." The write-in selection on the absentee 
ballot 180 has an associated box just like a registered 
candidate and should a voter chose the write-in option, they 
mark this box. This is the same method used for the GBO 65 
in the polling place. The difference resides in how the 
write-in candidate is recorded. At the precinct polling place, 
entry of the write-in candidate is accomplished through the 
use of the keyboard 106 provided by the voting tablet 56. 
The write-in candidates on the absentee ballot 180 are hand 
written by the voter. 

After the voter has completed marking all the boxes on the 
absentee ballot 180 with the top sheet 182 in place, including 
one or more write-in boxes, they remove the top sheet 182. 
By referencing the top sheet Ibi, the voter then locates :ne 
marked box on the bottom sheet 184 which indicates a 
write-in selection. The voter then prints, by hand, the name 
of the write-in candidate next to the marked write-in box on 
the bottom sheet 184. This is repeated for each write-in 
selection the voter wishes to cast. 
Absentee Voting Procedure 

The absentee ballot 180 is either given to the voter or is 
sent through the mail. Instructions provided outline the 
voting procedure and are as follows; 

1. Using a pen or a pencil, fill in the boxes corresponding to 
your selections. 

2. When finished, remove the perforated edges 190. 

3. Enter any write-ins using the lop sheet for reference. 

4. Discard the top sheet 182 of paper. 

5. Place the bottom sheet 184 in the provided envelope and 
return to headquarters 44. 

At this point, the bottom sheet 184 has the voter's 
selections marked on it and the preprinted bar code 192 and 
targets 194, but with none of the text associated with the 
ballot. The bottom sheet 184 is returned by hand or by mail 
to headquarters 44. Essentially, after completing the ballot 
180, the voter has manually created a two-dimensional code 
on the ballot 180 which can be read by the scanner 62. 
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Absentee Ballot Counting 

Once returned to headquarters 44 and after accumulating 
a certain amount of absentee ballots or just prior to the close 
of the election, the jurisdiction administrators load ihc 
ballots into an automatic document feeder that feeds (200) 
the ballots into the document scanner 62. The flow chart of 
FIG. 27 illustrates the process flow with each process step 
designated with a reference number in parentheses. The 
ballots are fed into the previously-described scanner 62, 
10 where an image is made (202) of the marks on the bottom 
sheet 184 of the absentee ballot 180. The scanning software 
used to process the image breaks up the scanned ballot into 
three divisions. The first division is the targets 194, which 
the .scanning software looks for first (204), Once located, the 
15 software uses the positional data supplied by the targets 194 
to set (206) the origin of the X-Y coordinates for the scanned 
ballot. Once the origin of the ballot is set, the software 
knows the exact location of the bar code 192 and voter 
marks made by the voter on the top sheet 182 that were 
20 transferred and recorded by ink or carbonless transfer. The 
image of the encoded bar code is then analyzed and decoded 
(208) to verify (210) that the ballot is legitimate. If not (212), 
an error message is displayed (214). The software then reads 
the issue number and the ballot style (216). The ballot style 
25 information tells the scanning software which ballot (218) it 
is currently imaging. Given the ballot style, the scanning 
software has access to the ballot creation information from 
the EAS 60 that gives a listing of positional information of 
the ballot selections for all the ballot styles. The scanning 
30 software reads the positional information for the current 
image and compares the possible selections contained in the 
ballot style with the image of the marks made by the voter 
on the bottom sheet 184 of the absentee ballot 180. From this 
analysis, the scanning software produces (228) a ballot 
35 image, identical to the ones produced in the precinct polling 
place when voting on a voting tablet 56. The positional 
information fetched from the ballot creation equates to a 
button pressed on a voting tablet 56 in the precinct polling 
place on election day. A ballot image is constructed by the 
40 scanning software and stores (230) it in a designated 
memory location. 

The present absentee system is ideally suited to handle 
any hand printed write-in voles cast by a voter. The docu- 
ment scanner is designed to handle optical character recog- 
45 nition (OCR) and there is a variety of commercial software 
available for converting handwriting into an electronic 
image. If an absentee ballot 180 has a write-in vote (220), 
the scanning software call the OCR routine (222) that 
interprets the handwritten entry. Depending on a jurisdic- 
50 tion's procedural requirements, the interpreted write-in is 
either compared to a list of approved write-in options (224), 
in which case an error message may be displayed (226), or 
just accepted. In either case, the interpreted write-in is stored 
as part of the ballot image given the variability in 
55 handwriting, the preferred embodiment simply stores the 
image of the write-in vote for an election oflGcial to evaluate 
its Iegitin-;hcy. This evaluation is performed with no knowl- 
edge of which ballot image is associated with the write-in, 
to maintain the secrecy and anonymity of the cast ballot. 
60 The automatic document feeder ejects (236) the current 
ballot and loads the next ballot and the process is repeated 
until all the ballots are read. 

This process happens very fast, with each ballot remain- 
ing in the scanner from ten to fifteen seconds. While the 
65 scanning software is going through its paces, the computer 
only displays status information. No information specific to 
the scanning process or about the current ballot image is 
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available to be displayed. All analysis occurs internal to the if that voter attempts to vote again ihey will be prohibited 

corapuier which maintains the privacy of the voier. The from doing so. When the precinct official enters the voter 

absentee ballot reading process is performed according to registration number in the TNC 50, the TNC 50 searches the 

jurisdiction procedure which contains provisions to prevent absentee information to find out whether the voter has cast 

fraud or tampering. ITicsc procedures can be as simple as 5 an absentee ballot. If so, the voter will not be approved for 

requiring two people to be present ai all times. voting in the precinct polling place. Some jurisdiction do not 

Built into the scanning software are provisions for han- use voter registration numbers and, in this instance, the 
dling an unreadable or anomalous ballot. Too many marks names of voters who have voted by absentee are printed out 
for a single race, misalignment, an unrecognizable write-in by the TOC printer 90. Precinct polling place officials then 
vole, or some other damage are some examples of poten- lo reference the list to prevent a voter from voting twice, 
tially anomalous ballots. The absentee system will kick The absentee ballot system of the present invention pro- 
ballots with these types of problems out of the scanner and vides several features and improvements over existing sys- 
reporl the anomalous condition for evaluation by jurisdiction terns. The present system provides absentee ballots that have 
administrators. The scanning software has a high degree of a similar appearance to the ballot as presented in the precinct 
capability in discriminating between which mark is valid, is polling place on election day and provides-a level of ano- 
For example, if a voter were to erase a selection and chose nymity not found in many other systems. By removing the 
another within a particular race without completely erasing top sheet 182, voting selections can only be determined if 
the previous one, the scanning software can discriminate someone keeps the returned bottom sheet 184 of the ballot 
between which mark has a higher degree darkness. The level and corresponding return envelope, decodes the bar code, 
of darkness in both gray scale and coverage area is used to 20 prints a corresponding top sheet 182 of the ballot style, and 
determine a valid selection. overlays that top sheet 182 on the returned bottom sheet. 
Issue Number This clearly would require a conspiracy to accomplish and 

The issue number printed on the ballot and subsequently would be traceable by the EAS 60 and scanning software, 
read by the document scanner is used to manage the eligi- The present absentee voting system thus provides a seam- 
bUity of voters. ITie confidential issue number is fed into the 25 less method for managing voter eligibility to prevent a voter 
administrative module of the EAS 60 and is matched (232), from voting more than once. By providing all absentee data 
then marked as returned within the absentee module of the to the precinct polling places through the MMU 58, a voter 
EAS 60. This information can further be used in the precinct is prevented from voting twice. This is an automated process 
polling place to prohibit a voter who has voted absentee not previously available or proposed. This also aUows a 
from voting on election day. When the absentee ballot 180 30 jurisdiction to comply with their applicable state laws which 
is produced, the name of the voter is associated with the may require absentee votes be counted in the precinct 
unique number assigned by the EAS 60. This number is polling place. Again, there is no system proposed or avail- 
internal to the computer and is never viewed by a human. able which offers this level of automation and provides the 
The issue number is incorporated into the bar code 192 and level of accuracy, security, and cost effectiveness, 
is printed on the ballot with the other information mentioned 35 Early Voting 

above. When the baUot is returned and the issue number An increasing number of votes arc being cast prior to the 

read, it is matched in the EAS data with the previously stored actual election day through the use of absentee ballots and 

number representing that the ballot was produced and sent early voting. Jurisdictions across the country have different 

out. After matchmg the numbers, the association with the rules, laws, and practices that preclude any one method from 

voter is severed and the name or voter registration number 40 being uniformly accepted. The system provides different 

of the voter is randomly stored (234) in a memory location. options and is flexible enough to fit within these various 

At this pomt, the voter*s name and/or voter registration preferences and legal constraints. The EAS 60 interfaces 

number is stored by the EAS 60 with precinct information directly to a means for converting absentee ballots into an 

and a baUot image is stored randomly in a separate memory electronic format. This converting means can include an 

location. The data indicates that the voter has voted and this 45 optical scanner, card, or bar code reader for absentee ballots 

mformation, coupled with the ballot image, are both stored It also has software functions for receiving and compiling 

randomly, with no capability to match the voter to their vote. this information for inclusion in the proper precinct for 

Absentee Data in the Precinct PolUng Place election day tallies. The system can also be used for eariy 

In one embodiment, where the MMU 58 is stored in the voting should the requirements of the jurisdiction mandate 

TNC 50 and the MMU 58 is downloaded with precinct data 50 it. Early voting can also be accomplished through the use of 

prior to the election, the downloaded information can precinct equipment that has been configured for early voting 

include all absentee data. The absentee data is made up of using the EAS "Early Voting" function, lliis differs from 

two separate data elements^the ballot images and the election-day precinct con figuration as the ballot is optimized 

voters who have cast absentee ballots. Each of these ele- lo handle a greater range of eligibility to minimize the 

ments have mformation which associates it with a specific 55 number of tablets required. Again, the EAS 60 has a specific 

precinct 48. When the precinct polling place equipment is software module that handles eariy voting information and 

set up m the precinct poUing place and the ballot installed, maintains this data for inclusion into the proper precinct for 

the bar code on the GBO 65 on the voting tablet 56 indicates election day tallies, 

which precinct 48 it is and enables the TNC 50 to read the Internet Voting 

absentee information from the MMU 58. The TNC 50 then 60 There exists a segment of the population for which the 

downloads only ballot style data for that particular precinct. methods of casting ballots described above remains imprac- 

The absentee ballot images are randomly stored with the tical. These arc primarily registered voters who are out of 

ballot rniages recorded at the precinct polling place. This town during an election and are unable to be present for 

provides for the absentee ballots 180 to be taUied in the election day. Absentee voting procedures, while designed for 
precinct polling place, a requirement for many jurisdictions. 65 persons unable lo be present for the election, requires the use 

rhe absentee data also provides information on the voters of mail service and can be unreliable in some foreign 

that have voted in the precinct polling place by absentee so locations. The present invention supports this segment of the 
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population by providing means for a rcgisiered voter to cast enci^ption/dccryption and digital signature capability is 

their vote using the Internet, as shown in FIG. 31. used to encrypt data prior to transmission and decrypt 

The Internet is a collection of computer networks that received data. This software operates in conjunction with the 

allow individual computers connected to it to communicate hardware device mentioned above. The digital signature 

with each other using a common communication protocol. 5 capability is used to authenticate data that is both transmitted 

Access to the Internet is provided through ^'servers" that arc and received. The standard communication protocols 

both public and private. Public servers are abundant and employed provide further protection and include Secure 

provide commercially available access around the world. Socket Layer (SSL) and Secure Multipurpose Internet Mail 

Private servers are used for a designated population who are (S/MINE) 

granted access. These aspects make the Internet well suited lO Vote collection over the Internet begins with initializing 

for voting, both domestically and international. The present the Internet host software with the election specifics. In the 

invention currently utilizes the Internet function to support preferred embodiment, an MMU 58 with the ballot styles 

foreign based voters, but also supports domestic use. Inter- stored on it delivered to the host PC and its contents 

net use continues to expand nationally and the present downloaded. The Internet software is able to format the 

invention offers a jurisdiction the option to provide Internet 15 various types of ballot styles from the electronic configura- 

voting on any level, from local to national tion data stored on the MMU 58. After verifying a successful 

The Internet voting system of the present invention download, sample ballots are viewed by an official to verify 
includes a personal computer (PC) with the capability to correct ballot translation and configuration. Other pre- 
read the MMU 58, the Internet host software, and commer- election tasks include clearing the ballot image and audit 
cially available security and communication software. The 20 storage areas and a systems and communication check of the 
PC is either the central computer 42 used for the EAS 60, or host PC. The election is now prepared to go on-line by 
a separate one that is networked to the EAS 60 or, a separate launching the Web page declaring the election open, 
stand alone PC , The preferred embodiment is a stand alone To begin the process of casting a ballot using the Internet, 
separate computer that is identical lo the central computer 42 a voter must be registered to vote. Depending on a jurisdic- 
except has a single, integrated MMU bay and a modem, 'ilie 25 tion's requirements the voter may be required to re-register 
Internet software is a custom developed software program to provide additional information. This may include sworn 
thai runs on the PC. The Internet software provides the statements, driver's license or birth certificate. The jurisdic- 
interface between the EAS output and commercial Internet tion may want to tender a Personal Identification Number 
communication software. Access to the Internet is either (PIN) to the voter. The voter PIN would be required to 
through a public, private or semi-private server. The public 30 access the voting option of the Web page. Once registered, 
server is the least desirable as there are typically a larger the voter accesses the jurisdiction's Internet site, typically 
number of users and could limit access. Further, a public referred to as a "home page" or Web site", and submits a 
server may be subject to intentional group attempts to jam or request to vote. The voter's computer must support the SSL 
clog the communication channel to prevent voting. The protocol, a common feature in popular Internet access soft- 
private server is applicable for larger jurisdictions that 35 ware (browse re). The voter then supplies information nec- 
would therefore, experience a greater amount of voters using essary to identify themselves according to the jurisdiction's 
the Internet. The private sever would not be susceptible to requirements. This can include passwords given at the time 
attempts at jamming or clogging. This is a preferred method of registration, digitized signature, or any form of biometrics 
but is less cost effective than the semi-private server. identification (i.e. fingerprints, retinal scan, voice print, etc.). 

'llie semi-private server is a dedicated server that is set up 40 The voter completes the Internet vote request and the 

for multiple jurisdictions using the Internet system of the jurisdiction is notified, through their home page, that the 

present invention. The semi-private server is maintained by request has been made. Information supplied includes the 

a trusted third party who manages the hardware and inter- requesting voter's electronic mail (e-mail) address. Prior to 

face software for connection to the Internet, A jurisdiction completing the request, the Internet software writes an 

woiild be connected to the semi-private server by a 45 identification file to the hard disk of the voter's computer, 

dedicated, secure digital line, such as a Tl or ISDN line. The file is created with data supplied by the Internet software 

This reduces the cost for a jurisdiction to utilizes the Internet and random information about the voter's computer (amount 

function of the present invention by simply requiring an of memory, autoexec.bat check sum, version of boot code, 

annual fee for the service. The semi-private server is dedi- etc.). The file is saved in a random directory and the Internet 

cated to the Internet voting function so that the hardware and 50 software makes a record of the location. The file can be 

software is optimized for its operation. locked to prevent access, encrypted or fragmented which 

In any server scenario, the basic hardware arrangements requires a proprietary algorithm to re-construct. 'ITie exist- 

are nearly the same. The jurisdiction has a host PC that runs ence of the identification file requires the voter to register 

the Internet software developed as part of the present inven- and cast their vote from the same computer. Should the 

tion. Additional commercially available software is also 55 file(s)becomecorrupledorthe voter change computers, they 

required such as an operating systems (Windows NT) and a have to start over with the request to vote. The identification 

secure Web browser. The server for the present invention file serves to fix the communication channel for the duration 

also includes commercial hardware and software necessary of the Internet voting process. 

for secure communications over the Internet. A hardware Election officials verify the information supplied by the 

device is used to generate encryption keys, store and manage 60 voter and approve the assignment of an issue number for the 

the keys and, perform bulk encryption/'decryption opera- voter. The issue number is electronically sent to the voter via 

tions. The software provides a "firewall" function, the Internet to the address supplied by the voter and defines 

encryption/decryption, digital signing, and support of secure the proper ballot style for the voter. The e-mail is sent using 

communication protocols. The firewall is typically estab- Secure Multipurpose Internet Mail (S/MIME) which is an 

lished in software and setup between the Internet and the 65 industry standard used for transmitting secure e-mail mes- 

hosl server. ITie firewall creates a single conduit which all sages. Once the voter receives the issue number, the voter is 

data must pass through, protecting data behind it. The able to cast one and only one ballot. The time required to 
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complete the Internet voting process lo this point can vary reliably stored, inventories maintained, periodically tested to 

from real lime to weeks. The actual time is dependent on the ensure its functionality, and deployed in mass prior to 

jurisdiction's requirements. election day and returned. For a jurisdiction of 200 

^^^c voter returns to the jurisdiction's home page and precincts, this can require the movement of 1000 pieces of 

selects the cast ballot option. A valid issue number is 5 equipment typically using volunteers that work the elections 

required to gain access lo the cast ballot option. The issue only once a year. 'Vht deployment and subsequent return of 

number contains similar information as the bar code used on the equipment must go smoothly or run the risk of delaying 

the absentee ballot of the present invention, including the the opening of the polls, or tallying of results. ITiese are 

correct ballot style for the voter Additional information is potential occurrences that an election administrator cannot 

included to identify the voter, such as e-mail address, lO tolerate. Furthermore, the equipment must be deployed with 

Internet access provider, caller-ID phone number and data a high degree of confidence as lo its functionality so that 

contained in the identification file created when the voter when delivered to the polling place it operates correctly, 

made Iheir request to vole. Given a valid issue number, the Given these requiremenLs, the present invention incorpo- 

idenlificalion file is verified as legitimate and the voter gains rales methods that provide for eflicieni management of 

access to the cast ballot selection. The Internet software is equipment at the warehouse. Preventive maintenance, accu- 

loads an executable code file and is written on the voter's rate inventory monitoring and tracking of equipment flow 

computer's hard disk. The ballot style information supplied are the key attributes of the warehousing system, 

by the issue number allows the Internet voting software to Preventative Maintenance 

retrieve the ballot style data from the database and display Election ofiScials will, at a minimum, perform a prc- 
it on the screen for the voter. The ballot, as viewed from the 20 election test of the voting systems 40 before they are 
voter's computer monitor, has a similar appearance as the deployed to the polling place. Previous voting systems 
absentee ballot 180 and, hence, the GBO 65. The voter required the oflBcials to set up and test the various compo- 
makes their selections by either scrolling or paging through nents and functions of the system. With such systems, 
the ballot. The voter is able to write-in and/or change their precinct oflBcials would again have to test the systems prior 
sel ections up until the cast ba Dot button is activated, just like 25 to opening the polls lo verify that the equipment was not 
the voting tablet. Once the voter activates the cast ballot damaged when it was moved to the precinct. While each 
button, the executable code stored previously encrypts the type of voting equipment (lever, punch card, optical scan, 
resulting data using information from the identification file and "direct recording electronics" or DRE) has their own 
and transmits the data packet to the Internet software host. particular test requirements, DREs have the greatest need for 
The Internet software, secure behind the firewall, decrypts 30 visual verification. Since lever-based systems and punch 
the transmission and converts the responses of the voter into cards systems are purely mechanical, testing their function- 
equivalent switch positions for the voting tablet. After ality requires physically operating the machine. Optical scan 
verifying valid switch positions, as indicated for the voter's systems require calibration of the ballot reader and a series 
ballot style, the Internet software randomly saves the ballot of test runs to statistically verify repeatability. The tests for 
image in a secure database and flags the issue number as no 35 these systems are time consuming and, given the mechanical 
longer valid. The Internet software transmits a confirmation, nature of the equipment, yield little infonmation on the future 
then removes the executable code and identification file. The performance of the system. 

voter has now cast their vote and is free to log off. Direct recording electronics (DRE) are typically 

The interface with the voter during the voting process can microprocessor-based and have internal diagnostics that test 

occur in any language, llie jurisdiction can provide different 40 the electronics of the system. The tests are performed very 

languages simply by the voter selecting their language of fast and are common to most computing devices in other 

choice at the beginning of the voting process. The format of industries. Previous DRE voting systems can perform their 

the process and ballot remain the same, it is just displayed diagnostics without completely setting up the machine, but 

in a different language. at a minimum must be plugged into a wall outlet for power. 

All information related to the communication between the 45 With these systems, the diagnostics fall short of providing 

Internet software host and the voter, including time, adequate test coverage and prevent election officials from 

duration, issue number and identification file, are also saved placing a high degree of confidence in the system's func- 

randomly as a file and disassociated with the cast ballot. This tionality. To gain the level of confidence required, the official 

data become part of the audit trail that chronicles each must set up the system in its fully-deployed position and 

Internet voting sequence. 50 manually test each machine by running a test routine to 

Periodically, the election official can download the ballot visually verify proper operation. The reason for this is that 

images stored on the Internet host to the EAS 60 for DREs provide visual feedback to the voter in response lo a 

inclusion with the other pre-election cast ballots (absentee selection when voting. Internal diagnostics do not lest ihis 

and/or eariy). The Internet voting site for a particular elec- feedback mechanism in previous systems. The critical 

lion can stay active up to and including election day with the 55 nature of the LED lo operation is found in the fact that it is 

site being disabled coincident with the closing of the polls. the primary communication means to the voter indicating 

However, a jurisdiction may choose to disable the site in how they have voted. 

advance of election day so that the ballot images from the To eliminate the need to set up the voting system to 

Internet can be combined with the absentee ballot images perform a functional test, the present invention provides 

and delivered to the precinct in the MMU 58. This allows 60 design innovations which precludes the need for set up. The 

these ballot images to be counted at the precinct, a require- Visual Vote Verification, V^^.^^^, teamed with implementation 

meni for many jurisdictions. of the CAN co.amunication protocol, allows election offi- 

Warehouse/Equipment Management cials to test in situ. The V^ system, as described above, is an 

When the voting equipment is not in use it is typically electronic circuit that determines whether or not an LED 102 

stored in a warehouse type location. Ilie warehousing of 65 is illuminated, llie present invention incorporates the use of 

voting equipment is as much a part of the election function the V^ system into the voting tablet self diagnostics so thai 

as collecting votes at a polling place. The equipment must be the visual feedback mechanism Ls fully tested. The diagnos- 
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lies for the LED 102 can be perlbrmcci while the voting another rack 160 of voting tablets 56 or TOCs 50. The power 

tablet 56 is tblded up and stored in the warehouse without is separated to prevent having to use a power cable with liigh 

removing it from its storage location or as a test prior to current carrying capacity. The data lines are connected to the 

opening the polls on election day. next rack 160 to continue the formation of a daisy-chained 

Warehouse Storage 5 network of up to five hundred devices. 

An important innovation in the present invention that Once all of the voting tablets 56 and TNCs 50 are stored 

supports this increased level of warehouse testing is the use ^''^^^^ ^"^ connected to the network and power, a 

of the Controller Area Network (CAN). Use of CAN enables computer can be connected to the end of the network data 

the voting tablets 56 and TNCs 50 of the present system to communication protocol of CAN architecture 

be connected together electronicallv in a network fashion. lO "^^^"^^ each device to be individually addressed on the 

This allows a desktop computer or mher computing means ^^^^ork. The controlling device (the aforementioned 

to be connected to the network and control each device on "7^" ^"^^^ communication software and secu- 

. 1 c- .u oAKr • . . i_i t_ "ty intormation about each device before is it able to 

the network. Since the CAN interconnect cable has power communicate with the devices. Given this information, the 

and data lines integrated together only one connection ,s controUing device can initiate the voting tablet 56 and TNC 

required for each devi^. 15 50 self-diagnostic routines. The voting tablet 56 and TNC 50 

The voting tablets 56 and TNCs 50 are stored in the self-diagnostic routines have designed-in reporting schemes 

warehouse on portable racks 160, similar to those used to ihat, given the proper authorization, will report back to the 

store pizzas. Each shelf of the "pizza racks" 160 is slightly controlling device the results of the diagnostics. 'ITie present 

larger than a voting tablet 56 in the transportation configu- invention offers fully automated testing and results reporting 

ration. The folded voting tablet 56 slides flat into a shelf 162 20 without moving a single piece of equipment, 

of the rack 160 on guide rails 164 in the rack 160. The guide A further advantage to the networked warehousing is 
rails 164 are spaced such that there is a couple of inches of found in programming the MMU 58. Most DREs use some 

clearance between voting tablets 56. The rack 160 can hold form of a memory cartridge that must be individually 

from eight to twelve voting tablets 56 each with the final programmed prior to the election. This is a time consuming 

number dependent on a jurisdiction's requirements. The 25 process that requires each memory cartridge to be plugged 

rack 160 is mounted on caster type wheels 166 suitable for into a programming device and the information downloaded, 

industrial mobility and have incorporated therein locking Prior systems further complicate this task as each memory 

means so that the rack 160 may be secured in a specific cartridge is assigned to a specific precinct. The present 

location. Material used in the construction of the rack 160 is invention has made the memory cartridges generic which 

typically aluminum or thin gauge steel wit ha rust prevention 30 improves over the complicated precinct assignment and 

coating. The rack 160 has four vertical tubes 168 with a fiirther simplifies the pre-programming of the MMUs 58. 

wheel 166 attached at the bottom of each and an end cap on With the TNCs 50 networked in the warehouse, the MMU 

the top to close off the mbe from environmental elements. 58 can be installed in the TNC 50 long before election day 

Horizontal "L" shaped guide rails 164 are provided on the and information can be downloaded literally minutes before 

sides of the rack 160 to define the shelves 162. The guide 35 the equipment is deployed. This is a tremendous savings in 

rails 164 are typically welded or riveted to the vertical tubes time and effort and accommodates last minute ballot 

168 and mounted such that there is a lip that faces toward the changes. With the MMUs 58 installed in the networked 

interior of the rack 160. The number of guide rails 164 per TNCs 50, the MMU 58 can be updated virtually in real time, 

side is equal to the storage capacity of the rack 160. There ^Fhis is an advantage prior to the election but there are also 

are three other "L" shaped members that are used at the back 40 benefits following the election. 

of the pizza rack 160 to connect the two sides of the rack Each TNC 50 stores an exact record of information 

160. Each of the other "L" shaped members is inverted contained in the MMU 58 after the election. The MMU 58 

relative to the side members with one located near the is used to transport ballots images back to headquarters after 

bottom, one in the middle, and one near the top of the rack. the polls are closed for the votes to be tallied. The TNC 50 

Exact position of these members is such that they do not 45 maintains an exact record of the MMU 58 information as a 

interfere with sliding the voting tablets 56 or TNCs 50 into back up. Once the TNC 50 is return from the poUing place 

the rack 160. to the warehouse and connected to the network, the juris- 

The pizza racks 160 have electronic cabling 170, inte- diction has instant access to the back-up information. Given 

grated as part of the construction. The cabling 170 is either the portability of the present invention, it is conceivable that 

routed through the interior of the vertical tubes 168 or is 50 the equipment would all be returned and connected on 

permanently attached on the exterior of the tube 168. In both election night thereby providing verification of vote totals ' 

cases, the rack cable 170 has interface connectors 172 before the election is even closed. Ill is is a tremendous asset 

branching off with the spacing matching the center point to a election official by giving them a redundant total to 

between the horizontal "L" shaped guide rails 164 on the verify election results, 

sides. The connectors 172 at each position are the mating 55 Equipment Deployment 

halfofthe CAN connectors on the voting tablet 56 and TNC Equipment deployment is managed by a part of the 
50. When each component is inserted into the rack 160, the warehouse management system that utilizes bar code scan- 
rack cable connector 172 can be mated with the device. The ning ano inventory management software. A flow chart of 
schematic of the cable has the power lines breaking away this process is illustrated in FIG. 28 with reference numbers 
from the data lines at the base and are spht into two separate 60 to the process steps in parentheses. Each voting tablet 56 and 
cables. The power line cable is connected to a transformer/ TNC 50 has an etched aluminum nameplate secured to the 
regulator device that converts 110 VAC to 12 VDC. The exterior of its enclosure. The nameplate has a unique bar 
transformer/regulator is a commonly available device and is code etched into it that uniquely identifies the voting tablet 
mounted at the base of the rack 160. The transformer/ 56 or TNC 50. When the equipment is to be deployed to the 
regulator has a power cord that is plugged into a wall outlet 65 poUing places, the poll workers can either come to the 
and provides "rack power". 'ITie data cable coming off the warehouse and pick up the equipment or, depending on a 
rack 160 is six to ten feet in length and is plugged into jurisdiction's requirements, the equipment can be delivered. 
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In the instance where the poll worker comes lo the array. Once downloaded, the TNC 50 verifies thai the serial 

warehouse and picks up the equipment, ihey provide their numbers ot" the connected voting tablets 56 are valid and that 

name and precinct number to a warehouse official. The the ballot codes are legitimate. This method of transferring 

warehouse authority enters (240 and 242) the information in election specific information to the precinct offers election 

the warehouse computer. ^Fhc warehouse computer runs the 5 officials the greatest tkxibiliiy in deploying equipment while 

warehouse software and contains information supplied by maintaining required levels of security. The only item pro- 

the CAS 60. The computer contains a list of on-hand duced for an election that is specific to a particular precinct 

equipment, as well as information about each polling place 48 is the graphical ballot overlay 65. All other data and 

and the assigned poll workers. The information from the equipment necessary for conducting an election is non- 

EAS 60 also includes the number of voting tablets 56 and lO precinct specific which greatly reduces the opportunity for 

TNCs 50 required for that particular polling location (246). errors in deployment and correction of failed components. 

The poll worker selects (248) the proper quantity of each Tlie election officials now perform a pre-election test to 

component and the wareh{)use official scans (250) the bar verify that all components are operating properly and that 

code on the nameplates. The warehouse software then they have the proper election definition and configuration, 

compares (252) the scanned bar codes against the equipment i5 The equipment is designed for very simple operation since 

list supplied by the EAS 60. After a match is made, the a large number of the poll workers may not be computer 

warehouse computer constructs an assignment record for literate. This requires that the equipment be able to check 

that transaction. The assignment record (254) contains all itself with very lit Ic supervision by the poll workers. The 

necessary information about the transaction, such as: time of voting tablet 56, 'P^^^. 50, and MMU 58 have designcd-in 

transaction; name of the poll worker; equipment assigned; 20 capability to perfo pre-election tests to verify aU infor- 

and the precinct number. The warehouse computer then mation prior to openmg the polls. The officials are required 

prints a receipt and internally saves the data (256). The poll to perform visual checks on the alignment of the GBO 65 

worker is then free to depart. The warehouse computer and available election choices. As part of the official 

updates the equipment-on-hand data to signify that those verification, each voting tablet is enabled with all choices 

pieces are no longer available for assignment, llie ware- 25 activated so thai officials verify alignment and that the TNC 

house official is not required lo be present, the poll worker 50 correctly identifies the ballot style in each voting tablet, 

can perform this task unsupervised should the jurisdiction Once all configurations have been verified, the remaining 

choose this method. task is to produce a "zero count" printout from the MMU 58, 

Upon returning (244), the poll worker name and precinct the primary ballot storage device. When the zero count is 

number are entered into the warehouse computer or the 30 requested, the TNC 50 erases the entire contents of the 

equipment bar code is scanned (260). Each method will FLASH memory in the MMU 58 and re-configurcs it to 

retrieve (258) the assignment record created when the equip- become the repository for cast ballots during the election, 

ment was checked out. The equipment is verified against the The polls are now ready to be open at the designated time, 

assignment record (262) and, if verified, the equipment is either automatically by the TNC 50 or manually by the 

received back into the warehouse. The warehouse computer 35 election officials and voting begins, 

updates (264) the on-hand equipment list, otherwise the Voting 

discrepancy is recorded (266). This provides for efficient and To begin the voting sequence, a voter presents the nec- 

accurate tracking of voting equipment assets for a jurisdic- essary identification to the election official. The validation of 

lion* the voter eligibility can be accomplished in several ways, 

The warehouse software will catch any discrepancies in 40 depending on the requirements of the jurisdiction. The 

this process and provide proper notification through the use preferred method is for the voter to present identification to 

of the computer screen and printer. the official who then locates the voter in the voter registra- 

Operation (Election Day) tion log produced by the EAS 60. The log contains the name 

The TNC 50, MMU 58, voting tablets 56, and privacy of the voter with an accompanying bar code designation, 

enclosures 54 are either delivered or are brought to the 45 Using the bar code scanner that is connected to the TNC 50, 

precinct 48 by the election officials and in all cases, the the official scans the code for that voter. At this point, the 

election officials bring the ballot(s) in the fonm of GBOs 65 voter has been verified to be in the proper precinct, it has 

and an MMU 58 in their possession. The election officials, been verified that he/she has not already voted, and an open 

or their employees assigned to the precinct, set up the voting station has been armed with the proper ballot style for 

equipment, install the assigned ballot in the voting tablet 56, 50 that voter. Of particular importance is that the contests that 

and power up the equipment. During power up several he/she is not eligible to vote on have been disabled by the 

events occur that prepare the equipment for the election. TOC 50 through selection of the proper ballot style. 'Tht 

When in the power up state, the TNC 50 performs a self test official directs him/her to their assigned booth and the voter 

and then performs a survey of tablets 56 connected to it. The enters the privacy enclosure. The authorization of the voter 

TNC 50 is the host for a serial connected network, such as 55 can also occur electronically as the TNC 50 has stored an 

a CAN, or a secure UHF spread spectrum wireless LAN, so electronic list in its memory. The election official looks up 

that the voting tablets 56 are either daisy chained to one the name of the voter using the function keys of the TNC 50, 

another or free standing with no communication cables and when the name is located and selected, the TNC 50 

attached. Each voting tablet 56 has an electronic serial automatically assigns a ballot style, 

number that is read by the TNC 50 and the ballot code is also 60 When the voter steps into the booth, the contest lights (i.e. 

read at this time. After all of the voting tablets 56 have been presidential, senatorial, etc.) highlighting the eligible contest 

inventoried, the ballots styles have been verified and no and measures Oii the voting tablet are illuminated and the 

errors have occurred (e.g., a voting tablet 56 did not have a display on the VTCB 98 of the voting tablet 56 flashes the 

ballot installed) the TNC 50 signals the operator that it is message "Begin voting, make your selections". The voter is 

now ready to configure the MMU 58 as the electronic ballot 65 then free to make his/her selections. When the voter selects 

box. ITie election data is read from the MMUs FLASH a candidate for governor, the race light for governor goes out 

memory and transferred to the TNCs FLASH memory and the di.splay shows the contest in a language that was 
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determined by either the bar code registration, or manually computer 42 at election headquarters 44 tor counting and the 

by the official as requested by the voter. Even after the voter digital signature is used by the EAS 60 to verify the contents 

selects a candidate, he/she is not bound by that selection of the MMU 58. The EAS 60 recalculates the signature using 

until later when he/she presses the "Cast Ballot" button 84. the knowledge of the keys and reads the data from the MMU 

Until the "Cast Ballot" button 84 is pressed, the voter is free 5 58. Once the MMU 58 is removed, an exact copy of the data 

to change any and all selections simply by pressing another remains intact in the TNC 50 as a back-up. This data is the 

switch 100 involving that same contest. As Ihe voter makes ^""^ voting tablets 56 and can immediately provide 

his selections, the current slate of the activated selections is unoflicial results for that precinct 48 by use of a precinct 

updated in the memory of the voting tablet 56 and the TNC printer. A third copy of the information is fractionally stored 

SO.Thememory of the voting tablet 56 stores a copy of what lO ^^^^ of the voting tablets 56. Each voting tablet 56 

the voter saw when he cast his ballot. This redundant ballot maintains a copy of all votes cast from that tablet 56. This 

image produced by the voting tablet 56 is generated by a stored data differs from the information stored in the TNC 50 

means other than switch activation, such as the sy.slem MMU 58 in that it is not stored in sum with the other 

described above. The primary ballot image is generated by voting tablets 56, This is important for two reasons. First, it 

a record of which switches 100 were selected by the voter, 15 provides a third, distributed, back-up source of sensitive 

then recorded, and then stored by the TNC 50. election data and secondly, it maintains a record of activity 

Once the voter has made his/her final selection, he/she of just that voting tablet 56 so that in the event the election 

presses the "Cast Ballot" button 84 and his/her vote is cast ^® challenged or there is a potential malfunction of the tablet 

and stored in permanent memory in each of the voting tablet ^^^^ ^'^^ t)e traced to the voting tablet level, lliis 

56, the TNC 50, and the MMU 58. The LEDs 102 go blank 20 Provides greater detail of audit information and offers a high 

and an audible tone is heard by the voter indicating that ^^^^^ ^f security. 

his/her vote has been recorded. The voter then exits the In addition to precinct results being printed from the TNC 

voting station 52, 50, by using a modem connected to the RS-232 port 86 on 

Until the voter presses the "Cast Ballot" button 84, his/her 50, the results can be instantaneously transmitted 

vote is not recorded. The TNC 50 and the voting tablet 56 25 telephone to any designated location, 

maintain the voter's selections in temporary memory until Tallying Results 

he/she activates the "Cast Ballot" button 84. At that point, MMUs 58 from the various precincts 48 are trans- 

the TNC 50 moves his/her selections, or cast ballot image, ported back to the central computer 42 where they are read 

into FLASH memory, both internal to the TNC 50 and in the inserting the MMU 58 into the ballot box bay 68. The 

voting tablet 56 while at the same time stripping any link 30 ^® ^^^^^ an MMU 58 into its database and simulta- 

between the cast ballot image and the voter's identification. neously shadows the data to the WORM drive 43. Once the 

An exact copy of the cast ballot image is moved into the MMU 58 is read and the data verified using the digital 

MMU 58 and a copy is read back and sent back to the voting signature, there now exists an exact copy of the MMU data 

tablet 56, The MMU 58 is the primary storage location while ^" WORM disk 43, creating a fourth copy of the data set. 

the TNC 50 and voting tablet 56 are back-up copies. The 35 proceeds to read all the MMUs 58 from the 

voting tablet 56 has two copies of the ballot. One version precincts 48, updating the election tally in real time, until all 

comes directly from the voting tablet V electronics and the MMUs 58 are read. The EAS 60 is now ready to produce 

other version is the one that has been stored by the TNC 50, oflHcial election results. 

These two versions are always the same except in the event Producing Reports 

of a communication error or malfunction when storing the 40 format of the election reports is set prior to the 

ballot. The voting tablet 56 is essentially auditing the TNC election. Again, given the various requirements across the 

50 and provides for a third copy of the cast ballots. country, the EAS 60 provides user-configurable reports to 

The TNC 50 maintains the fact that a voter has cast his/her ^^^^ ^ jurisdiction's needs. Once the reports are produced, 

vote but not which vote it was, which is an important aspect election is vahdated, closed, and stamped official, 

in assuring voter secrecy The voter's ballot image has the 45 WORM disk 43, with its complete record of the 

voter specific data stripped away when the image is stored. election, is archived in a manner decided by the jurisdiction 

The cast vote (in the form of a ballot image) is further stored ^ complete record of the election, 

randomly in memory to add to the voter's anonymity. When foregoing de.scription is considered as illustrative 

the vote is stored, it is kept intact so that an exact replica of °"^y of principles of the invention. Furthermore, since 

the cast vote could be reproduced should it be necessary. 50 numerous modifications and changes will readily occur to 

This is called a ballot "image", a term common to computer skilled in the art, it is not desired to limit the invention 

storage of data, and is part of the audit trail that can be used ^° ^^^^^ construction and process shown as described 

in the event that some aspect of the election comes into above. Accordingly, all suitable modifications and equiva- 

queslion. lents may be resorted to faUing within the scope of the 

Closing Polls 55 invention as defined by the claims which follow. 

When it is time for the election officials to close the polls invention claimed is: 

they do so by activating the TNC 50, whereupon several 1- electronic voting system for use in facilitating an 

events occur to protect the integrity of the election infor- election within a jurisdiction, comprising; 

mation. First, the statistics on the day's voting activity that ^ central computer; 

is stored in the voting tablet are downloaded to the TNC 50 60 a precinct unit, said precinct unit including a network 

and MMU 58 memory locations. Then using public encryp- controller; 

tion methods, a digital signature of the data stored in the a mobile memory unit, the mobile memory unit connect- 

MMU 58, the TNC 50, and the voting tablet is created and able to the central computer to provide data to and 

written into the memory of each component. The EAS 60 receive data from the central coi/iputer and connectable 

manages the encryption keys, their assignment to equipment 65 to the precinct unit to provide data to and receive data 

and calculation of their validity upon return from the pre- from the network controller, wherein data is stored in 

cmcts. The MMU 58 is transported back to the central the mobile memory unit in nonvolatile memory 
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a voting station, said voting station in data communica- 
tion said precinct unit, said voting station opcrably 
configiired to permit a voter to cast a ballot; and 

wherein the mtibile memory unit is transportable between 
the precinct unit and the central computer to convey 
data therebetween, said data including representations 
of a plurality of ballot styles for selected use according 
to precinct voting requirements across a plurality of 
precincts within the jurisdiction. 

2. An electronic voting system as defined in claim 1, 
wherein the mobile memory unit includes flash memory. 

3. An electronic voting system as defined in claim 1, 
wherein the mobile memory unit stores data magnetically. 

4. An electronic voting system as defined in claim 1, 
wherein the ballot styles provided to the precinct unit from 
the central computer via the mobile memory unit include a 
plurality of different ballot styles each formatted to present 
choices upon which a particular class of voter is eligible to 
vole and the Precinct unit is configured with Program 
instructions to present authorized voters at the voting station 
with ballots corresponding to eligibility of authorized voters 
by voter classification. 

5. An electronic voting system as defined in claim 1, 
wherein the voting station is adapted to send an image of a 
voter's cast ballot to be communicated to the network 
controller. 

6. An electronic voting system as defined in claim 1, 
wherein an electronic ballot image of the voters cast ballot 
is stored at the voting station. 

7. An electronic voting system as defined in claim 1, 
wherein the voting station includes a plurality of display 
indicators to provide a visible indication to a voter of ballot 
selections made by the voter, the voting station further 
including a plurality of sensors providing signals represen- 
tative of a state of the display indicators, the signals pro- 
viding a redundant indication to authenticate a ballot cast by 
the voter, the redundant indication of the cast ballot being 
stored at the voting station. 

8. An electronic voting system as defined in claim 1, 
including a plurality of voting stations, wherein the plurality 
of voting stations are connectable to each other with only 
one of the plurafity of voting stations directly connected to 
the network controller to allow the remaining voting stations 
to be connected indirectly to the network controller through 
the interconnection of the voting stations. 

9. An electronic voting system as defined in claim 8, 
wherein the plurality of voting stations are daisy-chained 
together. 

10. The voting system of claim 1, wherein said informa- 
tion associated with a ballot stored on said mobile memory 
unit includes bar code information. 

11. The voting system of claim 1, wherein said informa- 
tion associated with a ballot stored on said mobile memory 
unit includes a machine readable code. 

12. An electronic voting system for use in facilitating an 
election within a jurisdiction, comprising: 

a central computer for collecting ballots cast by voters; 

a plurality of mobile memory units, each mobile memory 
unit containing information representative of a plurality 
of ballot styles for selected use according to precinct 
voting requiremenLs across a plurality of precincts 
within the jurisdiction; and 

a plurality of voting stations communicating with the 
central computer, each voting station including one of 
said plurahty of mobile memory units, the voting 
stations each including a base with a plurality of voting 
switches, a plurality of display indicators, and a plu- 
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rality of sensors, the voting switches providing an 
indication to the central computer of the ballot cast by 
the voter, the display indicators providing a visible 
indication to the voter of the ballot selections made by 
5 the voter, the sensors providing signals representative 
of the state of the display indicators, the signals pro- 
viding a redundant indication to authenticate the ballot 
cast by the voter. 

13. The voting system of claim 12, including a ballot 
10 overlay for each of said plurality of voting stations, each 

ballot overlay including identifying information associated 
with at least one ballot. 

14. The voting system of claim 13, wherein said identi- 
fying information associated with at least one ballot includes 

15 bar code information. 

15. The voting system of claim 13, wherein each ballot 
overlay is associated with at least one ballot represented by 
said information contained on a mobile memory unit. 

16. The voting system of claim 12, wherein each said 
20 mobile memory unit includes a memory device. 

17. The voting system of claim 16, wherein said memory 
device stores data magnetically, 

18. An electronic voting system for use in facilitating an 
election within a jurisdiction, comprising: 

25 a central computer for collecting ballots cast by voters; 
a plurality of mobile memory units, each mobile memory 
unit containing information representative of a plurality 
of ballot styles for selected use according to precinct 
voting requirements across a plurality of precincts 
within the jurisdiction; and 
a plurality of voting stations communicating with the 
central computer, the voting stations each including a 
base with voting switches, the base being receptive of 
a ballot overlay, the ballot overlay including text or 
other symbology providing information to the voter 
relating to the various races and issues to be decided in 
the election, the ballot overlay further including a 
coded region thereon with a code representative of a 
ballot style encoded on the ballot overlay, the base 
including a code reader proximate to the coded region 
of the ballot overlay when the ballot overlay is placed 
in position on the base, the code reader being opera- 
tional to read the code encoded in the coded region of 
the ballot overlay and to supply the code to the voting 
station for configuring the voting system for the ballot 
style indicated by the code. 

19. The voting system of claim 18, wherein said code 
representative of a ballot style includes bar code informa- 
tion. 

20. The voting system of claim 18, wherein each of said 
plurality of mobile memory units stores information mag- 
netically. 

21. An electronic voting system for use in facilitating an 
election within a jurisdiction having an operational configu- 
ration and a storage configuration, comprising: 

a plurality of precinct units, each precinct unit including 

a network controller; and 
a plurality of voting stations, each voting station being in 
60 data communication with one of the plurality of pre- 
cinct units when said voting system is in the operational 
configuration, and each voting station being capable of 
being placed in data communication with one of the 
precinct units to communicate data while said voting 
65 system is in the storage configuration. 

22. An electronic voting system as defined in claim 21, 
wherein each voting station includes an external connector 
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for connection to the network controller that is accessible 
when the voting station is in the storage conligiiration. 

23. The voting system of claim 21, including a ballot 
overlay for each of said plurality of voting stations, wherein 
each ballot overlay includes coding associated with one of 
said plurality of ballot styles. 

24. An electronic voting system for use in facilitating an 
election within a jurisdiction, comprising: 

a central computer for collecting ballots cast by voters; 

a voting station, said voting station including a mobile 
memory unit containing information representative of a 
plurality of ballot styles for selected use according to 
precinct voting requirements across a plurality of pre- 
cincts within the jurisdiction; and 

said voting station being capable of eventually commu- 
nicating data to the central computer and -having a 
deployed configuration in which the voting station can 
receive selections from voters and a storage configu- 
ration in which the voting station folds to a fraction of 
the largest two-dimensional aspect of the voting station 
in the deployed configuration when placed in the stor- 
age configuration. 

25. An electronic voting system as defined in claim 24, 
wherein each voting station includes both a voting tablet that 
can communicate data and a privacy enclosure that at least 
partially encloses the voting tablet and the voter using the 
voting tablet. 

26. An electronic voting system as defined in claim 25, 
wherein each of the voting tablet and the privacy enclosure 
have a deployed and a storage configuration, and each fold 
to a fi-action of the largest two-dimensional aspect of the 
voting station in the deployed configuration when placed in 
the storage configuration. 

27. The voting system of claim 24, wherein said voting 
station includes a ballot overlay and said ballot overlay 
includes coded information associated with one of said 
plurality of ballot styles. 

28. An electronic voting system for use in facilitating an 
election within a jurisdiction, comprising: 

a central computer for collecting balloLs cast by voters; 
and 

a voting station, said voting station including a mobile 
memory unit containing iniormation representative of a 
plurality of ballot styles for selected use according to 
precinct voting requirements across a plurality of pre- 
cincts within the jurisdiction; said voting station being 
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adapted to communicate data to the central computer, 
said voting station also having a remote sensing termi- 
nal to receive inputs from disabled persons. 

29. An electronic voting system for use in facilitating an 
election within a jurisdiction, comprising: 

a central computer for collecting ballots cast by voters; 
a mobile memory unit containing information represen- 
tative of a plurality of ballot styles for selected use 
10 according to precinct voting requirements across a 
plurality of precincts within the jurisdiction; and 
a voting station adapted for communication with said 
central computer, said voting station having means for 
providing an audio output to voters who may be unable 
15 to read a ballot. 

30. A method for conducting an election, at least in part 
over a computer network including a central election com- 
puter and a plurality of remote computers accessible by a 
voter, the other computers being connected to the election 

20 computer through the network, the method comprising: 
providing a central election computer with a plurality of 

ballot styles for selected use according to precinct 

voting requirements across a plurality of precincts 

within the jurisdiction; 
receiving identifying information at said central election 

computer from a voter and authenticating the voter's 

identity; 

verifying the voter's eligibility to vote in the election and 
verifying that the voter has not yet voted in the election; 

serving a voter-specific ballot style to a remote computer 
accessed by the voter, said voter-specific ballot style 
being one of said plurality of ballot styles and said 
remote computer being in communication with said 
35 central election computer; and 

receiving information from the voter indicative of the 
voter's selections in the election. 

31. In an electronic voting system having a network and 
a controller, the improvement comprising providing the 

40 controller with multiple ballot styles for selected transmLs- 
sion to a plurality of voting stations according to voter 
eligibihty at each of said voting stations, said ballot styles 
being configured for selected use according to precinct 
voting requirements across a plurality of precincts within the 

45 jurisdiction. 

* « « 4i 
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